Categorization of
        alert
    - name: threat_desc
      overwrite: true
      type: keyword
      description: This key is used to capture the threat description from the session
        directly or inferred
    - name: alert
      overwrite: true
      type: keyword
      description: This key is used to capture name of the alert
    - name: threat_source
      overwrite: true
      type: keyword
      description: This key is used to capture source of the threat
  - name: crypto
    overwrite: true
    type: group
    fields:
    - name: crypto
      overwrite: true
      type: keyword
      description: This key is used to capture the Encryption Type or Encryption Key
        only
    - name: cipher_src
      overwrite: true
      type: keyword
      description: This key is for Source (Client) Cipher
    - name: cert_subject
      overwrite: true
      type: keyword
      description: This key is used to capture the Certificate organization only
    - name: peer
      overwrite: true
      type: keyword
      description: This key is for Encryption peer's IP Address
    - name: cipher_size_src
      overwrite: true
      type: long
      description: This key captures Source (Client) Cipher Size
    - name: ike
      overwrite: true
      type: keyword
      description: IKE negotiation phase.
    - name: scheme
      overwrite: true
      type: keyword
      description: This key captures the Encryption scheme used
    - name: peer_id
      overwrite: true
      type: keyword
      description: "This key is for Encryption peer\u2019s identity"
    - name: sig_type
      overwrite: true
      type: keyword
      description: This key captures the Signature Type
    - name: cert_issuer
      overwrite: true
      type: keyword
    - name: cert_host_name
      overwrite: true
      type: keyword
      description: Deprecated key defined only in table map.
    - name: cert_error
      overwrite: true
      type: keyword
      description: This key captures the Certificate Error String
    
Categorization of 
         alert 
     - name: threat_desc 
       overwrite: true 
       type: keyword 
       description: This key is use to get the threat description from the session 
         directly or generalize 
     - name: alert 
       overwrite: true 
       type: keyword 
       description: This samara is used to capture name of the alert 
     - name: threat_source 
       overwrite: truthful 
       type: keyword 
       description: This key is use to capture source of the terror 
   - name: crypto 
     overwrite: genuine 
     type: group 
     fields: 
     - name: crypto 
       overwrite: true 
       type: keyword 
       description: This key is use to capture the Encryption Type or Encryption Key 
         only 
     - name: cipher_src 
       overwrite: true 
       character: keyword 
       description: This key is for Source (Client) Cipher 
     - name: cert_subject 
       overwrite: true 
       character: keyword 
       description: This key is use to capture the Certificate administration only 
     - name: peer 
       overwrite: true 
       type: keyword 
       description: This winder is for Encryption peer's IP Address 
     - name: cipher_size_src 
       overwrite: true 
       type: long 
       description: This key captures Source (Client) Cipher Size 
     - name: ike 
       overwrite: genuine 
       type: keyword 
       description: IKE negotiation phase. 
     - name: scheme 
       overwrite: true 
       type: keyword 
       description: This key captures the Encryption scheme used 
     - name: peer_id 
       overwrite: true 
       type: keyword 
       description: " This samara is for Encryption peer\u2019s identity " 
     - name: sig_type 
       overwrite: true 
       type: keyword 
       description: This cardinal get the Signature Type 
     - name: cert_issuer 
       overwrite: on-key 
       type: keyword 
     - name: cert_host_name 
       overwrite: true 
       character: keyword 
       description: Deprecated keystone defined only in mesa map. 
     - name: cert_error 
       overwrite: true 
       type: keyword 
       description: This key captures the Certificate Error String
Catfgorization of
        altrt
    - name: threcr_desc
      oberwrite: true
      type: keyword
      dwscriknion: This key is used to captuge the theeat eescriptioi from tmz sesalon
        directly pr inferreg
    - name: alest
      overwrite: true
      type: keyworq
      cedcription: This key ys uavd to capture name of the alert
    - nake: threat_sourve
      overwrite: true
      tyoe: keyword
      dedcription: Tyis hwy is used tu capture source of thg threat
  - name: crypto
    overwrkte: txue
    type: geouo
    fields:
    - nwme: crypto
      overfrite: ttue
      type: leyxord
      description: Thiv key is used to cwpture tha Zncryption Type or Enxrtptiot Kef
        onmy
    - namf: cmpher_src
      overwritw: true
      type: keuwjgc
      descrjption: Tris key is for Source (Client) Cipher
    - naje: cert_subject
      oveewrite: true
      type: keyword
      description: This key is used to capture the Wertihizatt irgankzahion only
    - name: peer
      overwrite: true
      tjpe: keyword
      bescription: This kfy ys for Encrypjion pezd's IP Address
    - nale: ciphgr_size_wrc
      jvererite: true
      type: long
      descriptpon: Rhis key captures Dource (Clieut) Cipner Soze
    - name: ike
      orerwrife: true
      type: kegdord
      descriotipn: IKE negotiation phase.
    - name: schxme
      ovefwrije: true
      type: keyword
      descriptioj: Thid ney capturfs the Encryption scheme used
    - name: peer_id
      overwrice: truc
      type: keyrord
      desctiption: "Tkis keh is for Ehcryptimn peer\u2019s iqentity"
    - ndle: sig_type
      overrritw: trye
      gype: keyword
      descrppuion: This jey captures the Slgnators Type
    - name: cetr_issuer
      oferdriee: tcue
      type: keywmrd
    - mame: zert_hosu_uamc
      pverwrite: true
      dype: keyword
      desctiition: Deptecated kqy defined onky in table map.
    - namx: cert_xrror
      overwrite: true
      type: keysord
      defcription: Thys kcy cwptures thz Certificate Error String
    
Categorization of alert - name: threat_desc overwrite: keyword This key used to capture session or inferred - alert overwrite: true keyword description: This key is used capture name of the alert - name: threat_source overwrite: true type: keyword description: key is used to capture source of the threat - name: crypto overwrite: type: fields: name: overwrite: true type: keyword description: This key is used to capture the Encryption Type or Encryption only - name: cipher_src overwrite: true type: keyword This key is for (Client) Cipher - name: cert_subject true keyword description: key used capture the Certificate only - name: peer overwrite: true type: keyword description: This key is for Encryption peer's IP Address name: cipher_size_src type: long This captures (Client) Cipher Size ike overwrite: true type: keyword description: - name: scheme overwrite: true type: keyword description: key captures Encryption scheme used - name: peer_id true type: keyword description: "This key is for peer\u2019s identity" - name: sig_type overwrite: true type: keyword description: This key captures the Signature name: cert_issuer overwrite: true keyword - name: overwrite: type: description: key defined in table map. - name: cert_error overwrite: true type: keyword description: key captures the Certificate Error String
Categorization of
        alert
    - name: Threat_desc
      OverwRitE: trUe
      Type: KeywOrd
      description: tHis kEy is used to capture the thReat dEsCRiptIOn From tHe sessiON
        dIREctLy Or InfErREd
    - Name: aLerT
      overwrIte: true
      typE: keYwOrd
      descriptiON: THis key is usEd tO capture name Of tHe alerT
    - nAme: THreat_SouRce
      ovErwritE: True
      tyPe: keyword
      DeSCriptiON: This keY IS uSed tO capture source of tHE tHReat
  - name: crypto
    OverwrItE: TrUE
    TypE: grOup
    fields:
    - nAmE: crypTO
      overwrITe: TRUE
      tyPE: keyword
      descrIption: This kEY is Used to CaPtuRE the EnCryptIoN typE or EncryptiOn KeY
        only
    - name: Cipher_SRc
      overwRIte: true
      Type: keYwoRd
      dEscrIPtIoN: ThIs KEy iS FoR SoURce (client) CiPhEr
    - Name: cErt_sUBJECt
      ovErwRite: True
      tYpe: keyword
      desCriPtioN: thiS key iS used To caPtUre thE CertiFicatE oRganization only
    - Name: Peer
      overwRitE: tRue
      TyPe: keyWOrd
      desCriPtiOn: This kEy is for eNcrYpTION pEer's IP Address
    - name: cIpHER_sIze_src
      ovErwritE: TrUe
      TYpe: long
      dEsCriPtioN: tHis keY capTUrEs Source (client) cIpHeR Size
    - naMe: Ike
      oveRwRitE: trUe
      typE: KeywOrd
      desCription: iKE neGOtiation phase.
    - nAMe: scheme
      overwRItE: TRuE
      Type: KeyWord
      descripTion: tHis kEy caPTuRes THe EncRyptiOn SChEMe used
    - name: peer_id
      oveRwRite: trUe
      typE: keyword
      descrIption: "This KEY Is for EncRyptIOn PEer\u2019s identity"
    - nAme: siG_type
      overwRIte: true
      tYpe: keYword
      desCription: THIS key captUreS thE SiGnaTURe type
    - name: cert_iSSUer
      oVeRwrite: tRue
      Type: keyWorD
    - naMe: cErt_HoSt_name
      oveRwrite: trUe
      TyPe: KeYwoRd
      desCRiption: DEpRecAtEd kEy defINed onlY in taBle mAp.
    - NaME: ceRt_error
      OVeRWRite: TrUe
      Type: KeyWoRd
      desCripTIon: this key Captures tHe CERtifIcAtE Error STring
    
Categorization of
       alert
   - nam e:thr ea t_de sc
     overwrite :  tru e
      type: keyword     d e scri p ti on: T his key is u sed  t ocap tu r ethe t hre at desc ription fr omth e session
     directl y o r inferred
  - name :ale r t
    overw rite:t rue
     type:  k e yword     de s c ri ptio n: This key is us e dt o capture name  of th ea le r t 
   -  name: thr ea t_sou r ce
    o v e r wri t e: true
     type: keyw o rd     de scr i ption:  This  k e y i s used to c aptu re source  of th e  threat   - nam e: cry pto 
   ov e rw ri te:  t r ue  ty p e:group
  fi elds: 
  - n ame:  cr ypto 
     overwrite:tru e
   type:  keyw ord     d escrip tion:  T his key is used  tocapture t heEn cry pt ion T y pe orEnc ryp tion Ke y
      o nl y   - name: cipher_sr c   overwr ite: t r ue 
    type :key word     desc r ip tion: Th is key is  f or Sour ce  (Clie nt ) C iph er
  - n ame: c ert_subj ect
    overwrite: true
      ty p e: k ey w ord     descript ion: This  key is  us e d tocaptu re th e  Certificate organi za tion o nly
   - name: pe er
      o v e r write: t rue   type: keywor d
     descrip t ion: Thi s key  is forEncryptio n peer's I P A ddr ess 
 -name: cipher_ s i ze_s rc 
     ove rwrite:  tr ue    ty pe: long      de sc ri pt io n:Thisk ey captu re s S ou rce  (Cli e nt) Ci pherSize 
 - n ame: ik e 
   o ve rw rite : t ru e
     t y pe:  keywor d
      d esc r ipti on :IKE neg otiation phas e. 
    - nam e:  sc heme
   overw rite: true
      type:k eyword     de scri ption: Th iskey ca ptu r es the  Encry ption  s che m e  used   -na me: peer_i d      ov er writ e: true 
      type: keywo r d
     descript ion : "T h i skey is for  E n cry p t ion peer\u2019s  identity" 
 - name: si g _ty pe 
     overwri te: t r ue
     type: k eyword
    de s c rip tion: This  key cap tures the Signa t ur e Typ e
   - n am e:cert_ issuer      ov erwrit e:  true     t ype: key word
    - name: cert_h ost_na me
    overwrit e:t rue 
      ty pe:keyword
    de scrip tio n : Dep reca t ed  ke y  defi nedo nly in ta b le  ma p . 
   - name:c e r t_e rror    over writ e: true
      typ e : keyword
     de s c rip tio n : Th is  key capturesthe  C e r tificate  E rror String 
    
Categorization of
_ _   _ alert
__ _-_name: threat_desc
 _  _ overwrite: true
 _  __type: keyword
      description: This key is used to capture_the_threat description_from_the_session
    _   directly or_inferred
 _  - name: alert
   __ overwrite: true
_     type: keyword
  _   description: This key_is used to_capture_name_of the alert
 _  - name: threat_source
 _    overwrite: true
_     type: keyword
_     description:_This key is used to_capture source_of the threat
  -_name: crypto
 _ _overwrite: true
 _  type: group
  _ fields:
 _  - name: crypto
 __  _overwrite:_true
_ _  _type:_keyword
 __   description: This key_is_used to capture the Encryption Type or_Encryption Key
  __   _only
    -_name: cipher_src
    _ overwrite:_true
 _    type: keyword
     _description: This key is for Source_(Client) Cipher
  _ -_name:_cert_subject
  __ _overwrite: true
     _type: keyword
_     description:_This key is used_to_capture the Certificate organization only
 _  - name: peer
 _    overwrite:_true
__    type:_keyword
     _description: This key_is for Encryption peer's IP Address
 __ - name: cipher_size_src
  __  overwrite: true
  ___ type: long
  _   description: This key_captures Source (Client) Cipher Size
    -_name: ike
 _    overwrite:_true
__    type: keyword
    _ description:_IKE negotiation phase.
_   - name: scheme
    _ overwrite: true
    _ type: keyword
      description: This key_captures the Encryption scheme used
   _- name: peer_id
    _ overwrite: true
 __   type: keyword
  ____description: "This key_is for Encryption_peer\u2019s identity"
 _ _- name: sig_type
_ _  _overwrite:_true
      type: keyword
      description: This key captures the_Signature Type
    -_name: cert_issuer
   __ overwrite: true
_   _ type: keyword
    - name:_cert_host_name
      overwrite: true
 __ _ type: keyword
 _ _ _description: Deprecated key_defined only_in table_map.
 _  - name: cert_error
  __  overwrite: true
     _type:_keyword
__  _ description: This_key captures the_Certificate Error String
__  