---
title: "edr.darktrace"
canonical: "https://docs.devo.com/space/latest/327221267/edr.darktrace"
format: markdown
---
> Macro (toc)

## Introduction

The tags beginning with `edr.darktrace` identify events generated by [Darktrace](https://darktrace.com/).

## Valid tags and data tables 

The full tag must have 4 levels. The first two are fixed as** **`edr.darktrace`. The third level identifies the type of events sent. The fourth level indicates the event subtype.

These are the valid tags and corresponding data tables that will receive the parsers' data:

| **Product / Service** | **Tags** | **Data tables** |
| --- | --- | --- |
| Darktrace Response | `edr.darktrace.respond.antigena` | `edr.darktrace.respond.antigena` |
| `edr.darktrace.respond.incident_event` | `edr.darktrace.respond.incident_event` |
| `edr.darktrace.respond.model_breach` | `edr.darktrace.respond.model_breach` |
| `edr.darktrace.respond.status` | `edr.darktrace.respond.status` |
| `edr.darktrace.respond.summary` | `edr.darktrace.respond.summary` |

For more information, read more [About Devo tags](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126204).

## Table structure

These are the fields displayed in these tables:

> Macro (rw-ui-tabs-macro)
> 
> > Macro (rw-tab)
> 
> - [edr.darktrace.respond.antigena](#tag1)
> - [edr.darktrace.respond.incident_event](#tag2)
> - [edr.darktrace.respond.model_breach](#tag3)
> 
> ### > Macro (anchor)
> 
> edr.darktrace.respond.antigena
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *hostname* | `str` |  |  |  |
> | *codeid* | `str` |  |  |  |
> | *did* | `str` |  |  |  |
> | *ip* | `str` |  |  |  |
> | *ip_v4* | `ip4` | ```
> ip4(ip)
> ``` | *ip* |  |
> | *ip_v6* | `ip6` | ```
> ip6(ip)
> ``` | *ip* |  |
> | *ips* | `str` |  |  |  |
> | *action* | `str` |  |  |  |
> | *manual* | `bool` |  |  |  |
> | *triggerer* | `str` |  |  |  |
> | *label* | `str` |  |  |  |
> | *detail* | `str` |  |  |  |
> | *score* | `float8` |  |  |  |
> | *pbid* | `str` |  |  |  |
> | *model* | `str` |  |  |  |
> | *modeluuid* | `str` |  |  |  |
> | *start* | `timestamp` |  |  |  |
> | *expires* | `timestamp` |  |  |  |
> | *blocked* | `bool` |  |  |  |
> | *active* | `bool` |  |  |  |
> | *cleared* | `bool` |  |  |  |
> | *at_devo_pulling_id* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> edr.darktrace.respond.incident_event
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *summariser* | `str` |  |
> | *acknowledged* | `bool` |  |
> | *pinned* | `bool` |  |
> | *created_at* | `timestamp` |  |
> | *attack_phases* | `str` |  |
> | *mitre_tactics* | `str` |  |
> | *title* | `str` |  |
> | *id* | `str` |  |
> | *children* | `str` |  |
> | *category* | `str` |  |
> | *current_group* | `str` |  |
> | *group_category* | `str` |  |
> | *group_score* | `float8` |  |
> | *group_previous_groups* | `str` |  |
> | *activity_id* | `str` |  |
> | *grouping_ids* | `str` |  |
> | *group_by_activity* | `bool` |  |
> | *user_triggered* | `bool` |  |
> | *external_triggered* | `bool` |  |
> | *aia_score* | `float8` |  |
> | *summary* | `str` |  |
> | *periods* | `str` |  |
> | *breach_devices* | `str` |  |
> | *related_breaches* | `str` |  |
> | *details* | `str` |  |
> | *at_devo_pulling_id* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> edr.darktrace.respond.model_breach
> 
> > ⚠️ These logs may be collected via Devo collector or API endpoint. When `historicmodelonly` API request parameter value is se to `true`, some fields are defined directly under `model` field, instead of define `now` and `then` fields with these values. In that case, the parser will populate all these fields under `model_now_xxx` fields to avoid duplicate fields.
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *hostname* | `str` |  |  |  |
> | *comment_count* | `str` |  |  |  |
> | *pbid* | `str` |  |  |  |
> | *time* | `timestamp` |  |  |  |
> | *creation_time* | `timestamp` |  |  |  |
> | *model__then__name* | `str` |  |  |  |
> | *model__then__pid* | `int4` |  |  |  |
> | *model__then__phid* | `int4` |  |  |  |
> | *model__then__uuid* | `str` |  |  |  |
> | *model__then__logic__data* | `str` |  |  |  |
> | *model__then__logic__type* | `str` |  |  |  |
> | *model__then__logic__version* | `int4` |  |  |  |
> | *model__then__logic__target_score* | `int4` |  |  |  |
> | *model__then__throttle* | `int4` |  |  |  |
> | *model__then__shared_endpoints* | `bool` |  |  |  |
> | *model__then__actions__alert* | `bool` |  |  |  |
> | *model__then__actions__antigena__action* | `str` |  |  |  |
> | *model__then__actions__antigena__confirm* | `bool` |  |  |  |
> | *model__then__actions__antigena__duration* | `int4` |  |  |  |
> | *model__then__actions__antigena__threshold* | `str` |  |  |  |
> | *model__then__actions__breach* | `bool` |  |  |  |
> | *model__then__actions__model* | `bool` |  |  |  |
> | *model__then__actions__set_priority* | `bool` |  |  |  |
> | *model__then__actions__set_tag* | `bool` |  |  |  |
> | *model__then__actions__set_type* | `bool` |  |  |  |
> | *model__then__tags* | `str` |  |  |  |
> | *model__then__interval* | `int4` |  |  |  |
> | *model__then__delay* | `int4` |  |  |  |
> | *model__then__sequenced* | `bool` |  |  |  |
> | *model__then__active* | `bool` |  |  |  |
> | *model__then__deleted* | `bool` |  |  |  |
> | *model__then__read_only* | `bool` |  |  |  |
> | *model__then__modified* | `timestamp` |  |  |  |
> | *model__then__active_times__type* | `str` |  |  |  |
> | *model__then__active_times__version* | `int4` |  |  |  |
> | *model__then__auto_updatable* | `bool` |  |  |  |
> | *model__then__auto_update* | `bool` |  |  |  |
> | *model__then__auto_suppress* | `bool` |  |  |  |
> | *model__then__description* | `str` |  |  |  |
> | *model__then__behaviour* | `str` |  |  |  |
> | *model__then__version* | `int4` |  |  |  |
> | *model__then__mitre__tactics* | `str` |  |  |  |
> | *model__then__mitre__techniques* | `str` |  |  |  |
> | *model__then__priority* | `int4` |  |  |  |
> | *model__then__category* | `str` |  |  |  |
> | *model__then__compliance* | `bool` |  |  |  |
> | *model__now__name* | `str` |  |  |  |
> | *model__now__pid* | `int4` |  |  |  |
> | *model__now__phid* | `int4` |  |  |  |
> | *model__now__uuid* | `str` |  |  |  |
> | *model__now__logic__data* | `str` |  |  |  |
> | *model__now__logic__type* | `str` |  |  |  |
> | *model__now__logic__version* | `int4` |  |  |  |
> | *model__now__logic__target_score* | `int4` |  |  |  |
> | *model__now__throttle* | `int4` |  |  |  |
> | *model__now__shared_endpoints* | `bool` |  |  |  |
> | *model__now__actions__alert* | `bool` |  |  |  |
> | *model__now__actions__antigena__action* | `str` |  |  |  |
> | *model__now__actions__antigena__confirm* | `bool` |  |  |  |
> | *model__now__actions__antigena__duration* | `int4` |  |  |  |
> | *model__now__actions__antigena__threshold* | `str` |  |  |  |
> | *model__now__actions__breach* | `bool` |  |  |  |
> | *model__now__actions__model* | `bool` |  |  |  |
> | *model__now__actions__set_priority* | `bool` |  |  |  |
> | *model__now__actions__set_tag* | `bool` |  |  |  |
> | *model__now__actions__set_type* | `bool` |  |  |  |
> | *model__now__tags* | `str` |  |  |  |
> | *model__now__interval* | `int4` |  |  |  |
> | *model__now__delay* | `int4` |  |  |  |
> | *model__now__sequenced* | `bool` |  |  |  |
> | *model__now__active* | `bool` |  |  |  |
> | *model__now__read_only* | `bool` |  |  |  |
> | *model__now__modified* | `timestamp` |  |  |  |
> | *model__now__active_times__type* | `str` |  |  |  |
> | *model__now__active_times__version* | `int4` |  |  |  |
> | *model__now__auto_updatable* | `bool` |  |  |  |
> | *model__now__auto_update* | `bool` |  |  |  |
> | *model__now__auto_suppress* | `bool` |  |  |  |
> | *model__now__description* | `str` |  |  |  |
> | *model__now__behaviour* | `str` |  |  |  |
> | *model__now__message* | `str` |  |  |  |
> | *model__now__version* | `int4` |  |  |  |
> | *model__now__mitre__tactics* | `str` |  |  |  |
> | *model__now__mitre__techniques* | `str` |  |  |  |
> | *model__now__priority* | `int4` |  |  |  |
> | *model__now__category* | `str` |  |  |  |
> | *model__now__compliance* | `bool` |  |  |  |
> | *triggered_components* | `str` |  |  |  |
> | *breach_url* | `str` |  |  |  |
> | *score* | `float8` |  |  |  |
> | *device__did* | `str` |  |  |  |
> | *device__objecttype* | `str` |  |  |  |
> | *device__macaddress* | `str` |  |  |  |
> | *device__vendor* | `str` |  |  |  |
> | *device__sid* | `str` |  |  |  |
> | *device__hostname* | `str` |  |  |  |
> | *device__first_seen* | `timestamp` |  |  |  |
> | *device__last_seen* | `timestamp` |  |  |  |
> | *device__typename* | `str` |  |  |  |
> | *device__typelabel* | `str` |  |  |  |
> | *device__master* | `str` |  |  |  |
> | *device__ip* | `str` |  |  |  |
> | *device__ip_v4* | `ip4` | ```
> ip4(device__ip)
> ``` | *device__ip* |  |
> | *device__ip_v6* | `ip6` | ```
> ip6(device__ip)
> ``` | *device__ip* |  |
> | *device__ips* | `str` |  |  |  |
> | *device__devicelabel* | `str` |  |  |  |
> | *device__generatedlabel* | `bool` |  |  |  |
> | *at_devo_pulling_id* | `str` |  |  |  |
> | *aianalyst_data* | `str` |  |  |  |
> | *mitre_techniques* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> > Macro (rw-tab)
> 
> - [edr.darktrace.respond.status](#tag4)
> - [edr.darktrace.respond.summary](#tag5)
> - [edr.darktrace.respond.threats](#edr.darktrace.respond.threats)
> 
> ### > Macro (anchor)
> 
> edr.darktrace.respond.status
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |  |
> | *hostname* | `str` |  |  |  |
> | *time* | `str` |  |  |  |
> | *installed* | `timestamp` |  |  |  |
> | *mobile_app_configured* | `bool` |  |  |  |
> | *version* | `str` |  |  |  |
> | *ip* | `str` |  |  |  |
> | *ip_v4* | `ip4` | ```
> ip4(ip)
> ``` | *ip* |  |
> | *ip_v6* | `ip6` | ```
> ip6(ip)
> ``` | *ip* |  |
> | *models_updated* | `timestamp` |  |  |  |
> | *model_package_version* | `str` |  |  |  |
> | *bundle_version* | `str` |  |  |  |
> | *bundle_date* | `timestamp` |  |  |  |
> | *bundle_installed_date* | `timestamp` |  |  |  |
> | *hostname2* | `str` |  |  |  |
> | *inoculation* | `bool` |  |  |  |
> | *appliance_os_code* | `str` |  |  |  |
> | *license* | `timestamp` |  |  |  |
> | *saas_connector_license* | `timestamp` |  |  |  |
> | *antigena_saas_license* | `str` |  |  |  |
> | *syslog_tlssh_a1_fingerprint* | `str` |  |  |  |
> | *syslog_tlssh_a256_fingerprint* | `str` |  |  |  |
> | *antigena_network_csensor_enabled* | `bool` |  |  |  |
> | *antigena_network_csensor_license* | `timestamp` |  |  |  |
> | *antigena_network_enabled* | `bool` |  |  |  |
> | *antigena_network_license* | `timestamp` |  |  |  |
> | *log_ingestion_replicated* | `int4` |  |  |  |
> | *log_ingestion_processed* | `int4` |  |  |  |
> | *log_ingestion_tcp* | `int4` |  |  |  |
> | *log_ingestion_udp* | `int4` |  |  |  |
> | *license_counts__saas__azure_active_directory* | `int4` |  |  |  |
> | *license_counts__saas__total* | `int4` |  |  |  |
> | *license_counts__license_ip_count* | `int4` |  |  |  |
> | *type* | `str` |  |  |  |
> | *uptime* | `str` |  |  |  |
> | *system_uptime* | `str` |  |  |  |
> | *load* | `int4` |  |  |  |
> | *cpu* | `int4` |  |  |  |
> | *memory_used* | `int4` |  |  |  |
> | *instance_info__id* | `int4` |  |  |  |
> | *instance_info__down_count* | `int4` |  |  |  |
> | *instance_info__up_count* | `int4` |  |  |  |
> | *instance_info__down_time_ms* | `int8` |  |  |  |
> | *instance_info__down_time* | `timestamp` |  |  |  |
> | *instance_info__version* | `str` |  |  |  |
> | *instance_info__ip_address* | `ip4` |  |  |  |
> | *instance_info__label* | `str` |  |  |  |
> | *instance_info__bundle_version* | `str` |  |  |  |
> | *instance_info__bundle_date* | `timestamp` |  |  |  |
> | *instance_info__bundle_installed_date* | `timestamp` |  |  |  |
> | *instance_info__hostname* | `str` |  |  |  |
> | *instance_info__time* | `str` |  |  |  |
> | *instance_info__appliance_os_code* | `str` |  |  |  |
> | *instance_info__license* | `timestamp` |  |  |  |
> | *instance_info__saas_connector_license* | `timestamp` |  |  |  |
> | *instance_info__antigena_saas_license* | `str` |  |  |  |
> | *instance_info__syslog_tlssh_a1_fingerprint* | `str` |  |  |  |
> | *instance_info__syslog_tlssh_a256_fingerprint* | `str` |  |  |  |
> | *instance_info__antigena_network_csensor_enabled* | `bool` |  |  |  |
> | *instance_info__antigena_network_csensor_license* | `timestamp` |  |  |  |
> | *instance_info__log_ingestion_replicated* | `int4` |  |  |  |
> | *instance_info__log_ingestion_processed* | `int4` |  |  |  |
> | *instance_info__log_ingestion_tcp* | `int4` |  |  |  |
> | *instance_info__log_ingestion_udp* | `int4` |  |  |  |
> | *instance_info__license_counts__saas__azure_active_directory* | `int4` |  |  |  |
> | *instance_info__license_counts__saas__total* | `int4` |  |  |  |
> | *instance_info__license_counts__license_ip_count* | `int4` |  |  |  |
> | *instance_info__type* | `str` |  |  |  |
> | *instance_info__disk_utilization* | `int4` |  |  |  |
> | *instance_info__uptime* | `str` |  |  |  |
> | *instance_info__system_uptime* | `str` |  |  |  |
> | *instance_info__load* | `int4` |  |  |  |
> | *instance_info__cpu* | `int4` |  |  |  |
> | *instance_info__memory_used* | `int4` |  |  |  |
> | *instance_info__data_queue* | `int4` |  |  |  |
> | *instance_info__darkflow_queue* | `int4` |  |  |  |
> | *instance_info__network_interfaces_state_eth0* | `str` |  |  |  |
> | *instance_info__network_interfaces_address_eth0* | `ip4` |  |  |  |
> | *instance_info__network_interfaces_received_eth0* | `int8` |  |  |  |
> | *instance_info__network_interfaces_transmitted_eth0* | `int8` |  |  |  |
> | *instance_info__bandwidth_current* | `str` |  |  |  |
> | *instance_info__bandwidth_current_string* | `str` |  |  |  |
> | *instance_info__bandwidth_average* | `str` |  |  |  |
> | *instance_info__bandwidth_average_string* | `str` |  |  |  |
> | *instance_info__bandwidth7_day_peak* | `str` |  |  |  |
> | *instance_info__bandwidth7_day_peak_string* | `str` |  |  |  |
> | *instance_info__bandwidth2_week_peak* | `str` |  |  |  |
> | *instance_info__bandwidth2_week_peak_string* | `str` |  |  |  |
> | *instance_info__processed_bandwidth_current* | `int8` |  |  |  |
> | *instance_info__processed_bandwidth_current_string* | `str` |  |  |  |
> | *instance_info__processed_bandwidth_average* | `int8` |  |  |  |
> | *instance_info__processed_bandwidth_average_string* | `str` |  |  |  |
> | *instance_info__processed_bandwidth7_day_peak* | `int8` |  |  |  |
> | *instance_info__processed_bandwidth7_day_peak_string* | `str` |  |  |  |
> | *instance_info__processed_bandwidth2_week_peak* | `int8` |  |  |  |
> | *instance_info__processed_bandwidth2_week_peak_string* | `str` |  |  |  |
> | *instance_info__events_per_minute_current__network_connections* | `int4` |  |  |  |
> | *instance_info__events_per_minute_current__log_input_connections* | `int4` |  |  |  |
> | *instance_info__events_per_minute_current__c_sensor_connections* | `int4` |  |  |  |
> | *instance_info__events_per_minute_current__c_sensor_notices* | `int4` |  |  |  |
> | *instance_info__events_per_minute_current__c_sensor_device_details* | `int4` |  |  |  |
> | *instance_info__events_per_minute_current__c_sensor_model_events* | `int4` |  |  |  |
> | *instance_info__events_per_minute_current__network_notices* | `int4` |  |  |  |
> | *instance_info__events_per_minute_current__network_device_details* | `int4` |  |  |  |
> | *instance_info__events_per_minute_current__network_model_events* | `int4` |  |  |  |
> | *instance_info__events_per_minute_current__log_input_notices* | `int4` |  |  |  |
> | *instance_info__events_per_minute_current__log_input_device_details* | `int4` |  |  |  |
> | *instance_info__events_per_minute_current__log_input_model_events* | `int4` |  |  |  |
> | *instance_info__events_per_minute_current__saas_notices* | `int4` |  |  |  |
> | *instance_info__events_per_minute_current__saas_model_events* | `int4` |  |  |  |
> | *instance_info__connections_per_minute_current* | `int4` |  |  |  |
> | *instance_info__connections_per_minute_average* | `int4` |  |  |  |
> | *instance_info__connections_per_minute7_day_peak* | `int4` |  |  |  |
> | *instance_info__connections_per_minute2_week_peak* | `int4` |  |  |  |
> | *instance_info__operating_systems* | `int4` |  |  |  |
> | *instance_info__new_devices4_weeks* | `int4` |  |  |  |
> | *instance_info__new_devices7_days* | `int4` |  |  |  |
> | *instance_info__new_devices24_hours* | `int4` |  |  |  |
> | *instance_info__new_devices_hour* | `int4` |  |  |  |
> | *instance_info__active_devices4_weeks* | `int4` |  |  |  |
> | *instance_info__active_devices7_days* | `int4` |  |  |  |
> | *instance_info__active_devices24_hours* | `int4` |  |  |  |
> | *instance_info__active_devices_hour* | `int4` |  |  |  |
> | *instance_info__device_hostnames* | `int4` |  |  |  |
> | *instance_info__device_mac_addresses* | `int4` |  |  |  |
> | *instance_info__device_recent_ip_change* | `int4` |  |  |  |
> | *instance_info__models* | `int4` |  |  |  |
> | *instance_info__models_breached* | `int4` |  |  |  |
> | *instance_info__models_suppressed* | `int4` |  |  |  |
> | *instance_info__devices_modeled* | `int4` |  |  |  |
> | *instance_info__example_unidirectional_connections* | `str` |  |  |  |
> | *instance_info__recent_unidirectional_connections* | `int4` |  |  |  |
> | *instance_info__most_recent_dce_rpc_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_dhcp_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_dns_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_dtls_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_gssapi_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_h2_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_http_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_https_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_kerberos_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_ldap_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_llmnr_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_mdns_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_ntlm_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_ntp_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_smb_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_sm_b1_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_snmp_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_ssdp_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_ssh_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_ssl_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_stun_traffic* | `timestamp` |  |  |  |
> | *instance_info__internal_ip_range_list* | `str` |  |  |  |
> | *instance_info__internal_ip_ranges* | `int4` |  |  |  |
> | *instance_info__dns_servers* | `int4` |  |  |  |
> | *instance_info__internal_domains* | `int4` |  |  |  |
> | *instance_info__internal_and_external_domains* | `int4` |  |  |  |
> | *instance_info__proxy_servers* | `int4` |  |  |  |
> | *instance_info__subnets* | `int4` |  |  |  |
> | *instance_info__subnet_data* | `str` |  |  |  |
> | *instance_info__data_sync_time_ms* | `int8` |  |  |  |
> | *instance_info__data_sync_time* | `timestamp` |  |  |  |
> | *instance_info__antigena_network_enabled* | `bool` |  |  |  |
> | *instance_info__antigena_network_license* | `timestamp` |  |  |  |
> | *instance_info__antigena_network_running* | `bool` |  |  |  |
> | *instance_info__disk_space_used_var* | `int4` |  |  |  |
> | *instance_info__network_interfaces_state_eth1* | `str` |  |  |  |
> | *instance_info__network_interfaces_state_eth2* | `str` |  |  |  |
> | *instance_info__network_interfaces_state_eth3* | `str` |  |  |  |
> | *instance_info__network_interfaces_state_eth4* | `str` |  |  |  |
> | *instance_info__network_interfaces_state_eth5* | `str` |  |  |  |
> | *instance_info__network_interfaces_received_eth1* | `int8` |  |  |  |
> | *instance_info__network_interfaces_received_eth2* | `int8` |  |  |  |
> | *instance_info__network_interfaces_received_eth3* | `int8` |  |  |  |
> | *instance_info__network_interfaces_received_eth4* | `int8` |  |  |  |
> | *instance_info__network_interfaces_received_eth5* | `int8` |  |  |  |
> | *instance_info__network_interfaces_transmitted_eth1* | `int8` |  |  |  |
> | *instance_info__network_interfaces_transmitted_eth2* | `int8` |  |  |  |
> | *instance_info__network_interfaces_transmitted_eth3* | `int8` |  |  |  |
> | *instance_info__network_interfaces_transmitted_eth4* | `int8` |  |  |  |
> | *instance_info__network_interfaces_transmitted_eth5* | `int8` |  |  |  |
> | *instance_info__probes__1__id* | `int4` |  |  |  |
> | *instance_info__probes__1__version* | `str` |  |  |  |
> | *instance_info__probes__1__ip_address* | `ip4` |  |  |  |
> | *instance_info__probes__1__hostname* | `str` |  |  |  |
> | *instance_info__probes__1__time* | `str` |  |  |  |
> | *instance_info__probes__1__appliance_os_code* | `str` |  |  |  |
> | *instance_info__probes__1__syslog_tlssh_a1_fingerprint* | `str` |  |  |  |
> | *instance_info__probes__1__syslog_tlssh_a256_fingerprint* | `str` |  |  |  |
> | *instance_info__probes__1__antigena_network_running* | `bool` |  |  |  |
> | *instance_info__probes__1__log_ingestion_replicated* | `int4` |  |  |  |
> | *instance_info__probes__1__log_ingestion_processed* | `int4` |  |  |  |
> | *instance_info__probes__1__log_ingestion_tcp* | `int8` |  |  |  |
> | *instance_info__probes__1__log_ingestion_udp* | `int4` |  |  |  |
> | *instance_info__probes__1__type* | `str` |  |  |  |
> | *instance_info__probes__1__disk_utilization* | `int4` |  |  |  |
> | *instance_info__probes__1__uptime* | `str` |  |  |  |
> | *instance_info__probes__1__system_uptime* | `str` |  |  |  |
> | *instance_info__probes__1__load* | `int4` |  |  |  |
> | *instance_info__probes__1__cpu* | `int4` |  |  |  |
> | *instance_info__probes__1__memory_used* | `int4` |  |  |  |
> | *instance_info__probes__1__network_interfaces_state_eth0* | `str` |  |  |  |
> | *instance_info__probes__1__network_interfaces_address_eth0* | `ip4` |  |  |  |
> | *instance_info__probes__1__network_interfaces_state_eth1* | `str` |  |  |  |
> | *instance_info__probes__1__network_interfaces_received_eth0* | `int8` |  |  |  |
> | *instance_info__probes__1__network_interfaces_received_eth1* | `int8` |  |  |  |
> | *instance_info__probes__1__network_interfaces_transmitted_eth0* | `int8` |  |  |  |
> | *instance_info__probes__1__network_interfaces_transmitted_eth1* | `int8` |  |  |  |
> | *instance_info__probes__1__bandwidth_current* | `int4` |  |  |  |
> | *instance_info__probes__1__bandwidth_current_string* | `str` |  |  |  |
> | *instance_info__probes__1__bandwidth_average* | `int4` |  |  |  |
> | *instance_info__probes__1__bandwidth_average_string* | `str` |  |  |  |
> | *instance_info__probes__1__bandwidth7_day_peak* | `int4` |  |  |  |
> | *instance_info__probes__1__bandwidth7_day_peak_string* | `str` |  |  |  |
> | *instance_info__probes__1__bandwidth2_week_peak* | `int4` |  |  |  |
> | *instance_info__probes__1__bandwidth2_week_peak_string* | `str` |  |  |  |
> | *instance_info__probes__1__processed_bandwidth_current* | `int4` |  |  |  |
> | *instance_info__probes__1__processed_bandwidth_current_string* | `str` |  |  |  |
> | *instance_info__probes__1__processed_bandwidth_average* | `int4` |  |  |  |
> | *instance_info__probes__1__processed_bandwidth_average_string* | `str` |  |  |  |
> | *instance_info__probes__1__processed_bandwidth7_day_peak* | `int4` |  |  |  |
> | *instance_info__probes__1__processed_bandwidth7_day_peak_string* | `str` |  |  |  |
> | *instance_info__probes__1__processed_bandwidth2_week_peak* | `int4` |  |  |  |
> | *instance_info__probes__1__processed_bandwidth2_week_peak_string* | `str` |  |  |  |
> | *instance_info__probes__1__connections_per_minute_current* | `int4` |  |  |  |
> | *instance_info__probes__1__connections_per_minute_average* | `int4` |  |  |  |
> | *instance_info__probes__1__connections_per_minute7_day_peak* | `int4` |  |  |  |
> | *instance_info__probes__1__connections_per_minute2_week_peak* | `int4` |  |  |  |
> | *instance_info__most_recent_apns_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_ftp_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_grpc_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_imap_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_java_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_ncp_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_netlogon_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_po_p3_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_samr_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_sip_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_smtp_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_socks_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_winreg_traffic* | `timestamp` |  |  |  |
> | *instance_info__most_recent_xmpp_traffic* | `timestamp` |  |  |  |
> | *instance_info__internal_domain_list* | `str` |  |  |  |
> | *instance_info__internal_and_external_domain_list* | `str` |  |  |  |
> | *instance_info__proxy_server_ips* | `str` |  |  |  |
> | *at_devo_pulling_id* | `str` |  |  |  |
> | *hostchain* | `str` |  |  | **✓** |
> | *tag* | `str` |  |  | **✓** |
> | *rawMessage* | `str` |  |  | **✓** |
> 
> ### > Macro (anchor)
> 
> edr.darktrace.respond.summary
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *usercredentialcount* | `int4` |  |
> | *bandwidth* | `str` |  |
> | *antigena_devices* | `int4` |  |
> | *antigena_actions* | `int4` |  |
> | *subnets* | `int4` |  |
> | *patterns* | `int4` |  |
> | *devicecount__saas__azure_active_directory* | `int4` |  |
> | *devicecount__saas__total* | `int4` |  |
> | *devicecount__license_ip_count* | `int4` |  |
> | *devicecount__total* | `int4` |  |
> | *devicecount__unknown* | `int4` |  |
> | *devicecount__total_server* | `int4` |  |
> | *devicecount__total_client* | `int4` |  |
> | *devicecount__total_other* | `int4` |  |
> | *at_devo_pulling_id* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |