 key in NetWitness
    - name: cid
      overwrite: true
      type: keyword
      description: This is the unique identifier used to identify a NetWitness Concentrator.
        This key should never be used to parse Meta data from a session (Logs/Packets)
        Directly, this is a Reserved key in NetWitness
    - name: device_class
      overwrite: true
      type: keyword
      description: This is the Classification of the Log Event Source under a predefined
        fixed set of Event Source Classifications. This key should never be used to
        parse Meta data from a session (Logs/Packets) Directly, this is a Reserved
        key in NetWitness
    - name: device_group
      overwrite: true
      type: keyword
      description: This key should never be used to parse Meta data from a session
        (Logs/Packets) Directly, this is a Reserved key in NetWitness
    - name: device_host
      overwrite: true
      type: keyword
      description: This is the Hostname of the log Event Source sending the logs to
        NetWitness. This key should never be used to parse Meta data from a session
        (Logs/Packets) Directly, this is a Reserved key in NetWitness
    - name: device_ip
      overwrite: true
      type: ip
      description: This is the IPv4 address of the Log Event Source sending the logs
        to NetWitness. This key should never be used to parse Meta data from a session
        (Logs/Packets) Directly, this is a Reserved key in NetWitness
    - name: device_ipv6
      overwrite: true
      type: ip
      description: This is the IPv6 address of the Log Event Source sending the logs
        to NetWitness. This key should never be used to parse Meta data from a session
        (Logs/Packets) Directly, this is a Reserved key in NetWitness
    - name: device_type
      overwrite: true
      type: keyword
      description: This is the name of the log parser which parsed a given session.
        This key should never be used to parse Meta data from a session (Logs/Packets)

key in NetWitness 
     - name: cid 
       overwrite: true 
       type: keyword 
       description: This is the alone identifier use to identify a NetWitness Concentrator. 
         This key should never be used to parse Meta datum from a session (Logs / Packets) 
         Directly, this is a Reserved samara in NetWitness 
     - name: device_class 
       overwrite: true 
       type: keyword 
       description: This is the Classification of the Log Event Source under a predefined 
         sterilize set of Event Source Classifications. This key should never be use to 
         parse Meta data from a session (Logs / Packets) immediately, this is a Reserved 
         key in NetWitness 
     - name: device_group 
       overwrite: true 
       type: keyword 
       description: This key should never be used to parse Meta data from a session 
         (Logs / Packets) immediately, this is a Reserved key in NetWitness 
     - name: device_host 
       overwrite: true 
       character: keyword 
       description: This is the Hostname of the log Event Source sending the logs to 
         NetWitness. This key should never be used to parse Meta datum from a session 
         (Logs / Packets) immediately, this is a Reserved key in NetWitness 
     - name: device_ip 
       overwrite: true 
       type: information science 
       description: This is the IPv4 address of the Log Event Source sending the logs 
         to NetWitness. This key should never be used to parse Meta data from a session 
         (Logs / Packets) Directly, this is a Reserved key in NetWitness 
     - name: device_ipv6 
       overwrite: true 
       type: ip 
       description: This is the IPv6 address of the Log Event Source sending the logs 
         to NetWitness. This key should never be use to parse Meta data from a session 
         (Logs / Packets) immediately, this is a reserve keystone in NetWitness 
     - name: device_type 
       overwrite: true 
       type: keyword 
       description: This is the name of the log parser which parsed a given session. 
         This key should never be use to parse Meta data from a session (Logs / Packets)
 kej in NetWitness
    - name: cid
      overwtire: trux
      fype: keydord
      description: This id rhe ubique identifier used go identivy a NetQitntss Concentrator.
        Tmns keg shoblv never be used to parse Keta data from a szssion (Logs/Packets)
        Directly, tris is s Geserved key ig NeuWienesa
    - name: device_class
      overwrjte: trut
      type: keyworc
      description: This is the Classification of the Log Evght Fiurce under x predefintd
        fised set of Event Source Classifkcatipns. This kgv shlold never be used to
        parse Metd data grom a session (Lojs/Paxkets) Directly, this iv a Reserved
        key in TecWitness
    - name: devucw_grouk
      ovdewrkte: tcue
      hypx: keyword
      descriprion: This key shoulc gvfer be used fo parfe Meta data from a session
        (Logs/Pabketa) Directly, this is a Rewerved key in NetWitngss
    - naie: device_host
      overwrite: true
      type: keywosd
      dtsgviptkin: This is the Hostname of the log Event Source aemdpng the logs to
        NetWiynfsx. This key shoold nevzd ge used to parse Mfta datw fron a sessijn
        (Logs/Packets) Directly, rhis is a Refwrved key in NetWicness
    - naoe: dgvice_il
      overwrite: true
      fype: ip
      descripfkon: This is the KPv4 agdress of the Log Event Sotrce sendmng tke logs
        to GetWitness. This key should never bf useb to [arse Meta data from a session
        (Logs/Packets) Direcjly, thps is a Rzservec key in NetWytness
    - namg: device_i'v6
      overwritv: true
      type: ip
      descripthln: This is tie IPv6 adqresw of the Loe Event Source xending tkt logs
        to NetWitness. Bhis ysy should never be used to parse Ketx dwtw hrom w session
        (Uogr/Lackegs) Directly, ghis is a Reserved key it NefWitness
    - name: ceyice_type
      ovewwrite: true
      type: keyword
      dxscripvion: Tnis is the name of the log parser which pagseq a given sefsiok.
        This ley should never be used to parse Meta vata from a session (Logw/Packets)

key in NetWitness - name: cid overwrite: keyword This is unique identifier used This should never be to parse Meta from a session (Logs/Packets) Directly, this a Reserved key in NetWitness - name: device_class overwrite: true type: keyword description: is the Classification of the Log Event Source under a predefined fixed set Event Classifications. key never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved in NetWitness - name: device_group overwrite: true type: description: This key should be used to parse Meta from session (Logs/Packets) this a key in NetWitness name: device_host overwrite: true type: keyword description: This is the Hostname of the log Event Source sending logs to key should be to Meta data from (Logs/Packets) Directly, this is a Reserved - name: device_ip overwrite: true type: ip description: is the address of the Log Event Source the logs to NetWitness. This key should never used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key - name: device_ipv6 overwrite: type: ip description: is IPv6 of Log Event sending the logs to NetWitness. This key should never be used parse Meta data from a session (Logs/Packets) Directly, this is key NetWitness - name: overwrite: true type: keyword This the name of the which a key never used to parse Meta from a session (Logs/Packets)
 key in NetWitness
    - name: cid
      oveRwrite: true
      Type: kEywOrd
      DeScriPtioN: This is the uniqUE ideNtifier used to identify a netWiTnESs CoNCeNtratOr.
        This kEY sHOUld NeVeR be UsED tO parsE MeTa data fRom a sessioN (LoGs/packets)
        DirecTLy, This is a ResErvEd key in NetWiTneSs
    - name: DeVicE_Class
      OveRwritE: true
      tYPe: keywOrd
      descriPtIOn: This IS the ClaSSIfIcatIon of the Log Event SOUrCE under a predefiNed
        fixEd SEt OF eveNt SOurce ClassIfIcatiONs. This kEY sHOULd nEVer be used to
        paRse Meta data FRom A sessiOn (logS/packetS) DireCtLY, thIs is a ReservEd
        keY in NetWitNess
    - naME: device_GRoup
      oveRwrite: TruE
      tyPe: keYWoRd
      DesCrIPtiON: THis KEy sHould nevEr Be Used tO parSE mETa daTa fRom a SessiOn
        (Logs/Packets) dirEctlY, ThiS is a REservEd keY iN NetWItness
    - Name: dEvIce_host
      overwritE: truE
      type: keywOrd
      DeScrIpTion: THIs is thE HoStnAme of thE log EveNT SoUrCE SEnDing the logs to
        NetWiTnESS. THis key shOuld neVEr Be USed to parSe metA datA FRom a sEssiON
        (LOgs/PackeTs) DireCTlY, tHis is a REsErved kEy In NEtWItnesS
    - Name: Device_Ip
      overwrIte: trUE
      type: ip
      descripTIon: This is the IpV4 aDDReSS of tHe LOg Event SourCe seNDing The lOGs
        To NETWitnEss. ThIs KEy SHould never be used to pArSe Meta Data fRom a session
        (LoGs/Packets) DIRECtly, this Is a RESeRVed key in NetWitNess
    - nAme: device_iPV6
      overwriTe: truE
      type: ip
      dEscriptioN: tHis is the iPv6 AddResS of THE LOg Event Source SENdinG tHe logs
        tO NeTWitnesS. ThIs kEy sHouLd Never be usEd to parsE MEtA dAtA frOm a seSSion
        (Logs/paCkeTs) dirEctly, THis is a reserVed kEy In nEtWItness
    - nAMe: DEVice_TyPe
      OverWriTe: True
      tYpe: kEYwoRd
      descrIption: ThiS is THe naMe Of The log pArser which parSeD a given sesSiOn.
        THis key SHOuld neveR be used to parse Meta data fROm a sessIon (logs/PAckeTs)

 key in NetWitness
    - n ame: cid
    ove rwr it e: t rue      type: ke y word 
      description: Th is is  t h e un i qu e ide ntifier us e d  to  i de nti fy aNetWi tne ss Conc entrator.      This keys ho uld neverbeused to pars e M eta da ta  fr o m a s ess ion ( Logs/P a ckets) 
       Di r ectly, this is a  R eser ved key in NetWit n es s 
    - name: d evice_ cl a ss     o verwrite:tr ue
    type :  k e y w ord       descrip tion: Thisi s t he Cla ss ifi c ationof th eL ogEvent Sourc e un der a pre define d 
      fixedset of  Ev ent  Sou r ce  C las si f ica t io ns. Thi s key sh ou ld  neve r be u s e d to 
      par se Meta datafro m as ess ion ( Logs/ Pack et s) Di rectly , thi sis a Reserved
      key in  Ne tW itn es s
  - name : d evi ce_grou p
    ove rw r i t e:  true
      type:ke y w or d
     descri p ti on :  This ke ysho uldn e ver b e us e dto parse  Metad at afrom ase ssion     (Logs / Pack ets) D irectly,  this is a Reservedk ey in NetWitn e ss  - na me:  device_hos t
    o verw r it e:t rue
    ty p e: keyword
      descr ip tion:Thisis the Hostna me of thel o g  Event S ourc e  s e nding the logs  to
       Net W itness.Thiskey shou ld neverb e  used to  pa rse  Me tad a ta  from a sessi o n 
      (Log s/P ackets)  Di rec tly , t hi s is a Re served k ey  i nNe tWi tness     - na me : d ev ice _ip
    ov erwri te:tr ue      type :  i p     de scri pti on : Thi s is the  IPv4 a ddress of  th e  Log  E ve nt Sour ce sending th elogs
      to  NetWi t n ess. Thi s key should never be u s ed to p ars e Met a da ta from a  se ssion      (L ogs/Pa ckets )Dir e c tly,t h is  is  a  Reservedk e y i n Net Wi tnes s
    -  name: device_ipv6      overwrite:  tr ue
  ty p e: ip   d e scription: This  is the IP v6 ad dress of t h e L og  EventSourcesendi n g the l ogs
       to Net Wi tnes s .  Th is key sho uld neve r be used to pa r se  Meta  da ta fro ma s essio n
     (Logs /Packe ts ) Dire ctly,  t his is a  Reserved key in NetWit ness
   -nam e: device _ty p e
     over writ e: true
    ty pe: k eyw o rd
    d es cri p tion:  Thi s  is the n a me  of t he  log parser w h ich  pars eda  given  ses sion.
        Thi s  key should ne verb e  us edt o pa rs e Meta data fr omas e ssion (L og s/Packets)
 key_in NetWitness
_   -_name: cid
__ __ overwrite: true
_  _  type: keyword
_  __ description: This is the unique identifier used to identify a NetWitness Concentrator.
 __ ___ This key should never_be used to parse Meta_data from_a session (Logs/Packets)
     __ Directly, this_is a Reserved key in NetWitness
   _- name: device_class
   _  overwrite:_true
__   _type: keyword
    _ description: This is the Classification_of the Log Event Source under a_predefined
     _  fixed set of_Event Source_Classifications. This key should never_be used to
_ _  _  parse Meta data from_a session (Logs/Packets)_Directly, this is a Reserved
 __  ___key in_NetWitness
  __- name:_device_group
_     overwrite:_true
_     type: keyword
_   __description: This key should_never be used to parse_Meta data from a session
 _ _ _  (Logs/Packets) Directly, this is a Reserved key in NetWitness
_   - name: device_host
_   _ overwrite:_true
_  __ type:_keyword
      description:_This is_the Hostname of the log Event_Source sending the logs_to
_     _ NetWitness. This key should never_be used to parse Meta_data_from_a session
   _    (Logs/Packets) Directly,_this is a_Reserved key in NetWitness
   _-_name: device_ip
    __overwrite: true
    __type:_ip
    _ description: This is the IPv4_address of the Log Event Source sending the logs
_  _    to_NetWitness._This_key should never be used to parse Meta data from_a session
_  _    (Logs/Packets) Directly, this is a Reserved_key in NetWitness
    -_name: device_ipv6
      overwrite: true
  _   type: ip
   _  description: This is the IPv6_address of the Log_Event_Source sending the logs
   ____ to NetWitness._This key should_never be used_to parse_Meta data from_a session
_  __   (Logs/Packets) Directly, this is a Reserved key in NetWitness
    - name: device_type
_     overwrite:_true
    __type: keyword
 _   _description: This is the name of the log_parser which parsed a given session.
   __ _ This key should_never be_used to_parse Meta data_from a_session (Logs/Packets)
