Network security metadata fields in Vectra AI

This page provides a structured reference of network security metadata fields used across the Vectra AI Platform. It defines common schema attributes, session-layer connectivity fields, protocol-specific telemetry (DNS, HTTP, SMB, LDAP, etc.), authentication metadata (Kerberos, NTLM, RADIUS), detection-layer match attributes, and encrypted communication fingerprints (SSL/TLS, SSH, X.509). These normalized metadata streams enable behavioral analysis, cross-domain correlation, and encrypted traffic visibility without requiring full packet capture. Together, they form the foundation for scalable network observability and security investigation across hybrid enterprise environments.

These normalized metadata streams support threat hunting, metadata enrichment, and metadata forensics by enabling behavioral analysis, cross-domain correlation, and encrypted traffic visibility, without requiring full packet capture. Together, they form the foundation for scalable network observability and investigation across hybrid enterprise environments.

Common network metadata fields across all telemetry streams (except DHCP)

These fields appear in nearly every metadata stream and define the shared connection schema used across metadata types. They capture origin and responder identifiers, ports, hostnames, locality flags, sensor attribution, timestamps, and a stable connection UID.

Treat these fields as baseline join keys. They anchor metadata enrichment workflows by allowing protocol, authentication, and detection records to be tied back to the same session and entity. In threat hunting and metadata forensics, this consistency enables reliable pivoting across telemetry layers.

Most protocol tables that follow extend this schema while inheriting this shared context. This preserves attribution integrity and session continuity across network metadata streams.

Beacon metadata fields and behavioral communication patterns

Beacon metadata describes repeated communication between an origin and a destination across multiple sessions. The fields below capture the beacon identifier, timing boundaries, session count, byte volume by direction, protocol/service context, and client fingerprinting used to summarize the pattern.

Beacon analysis is frequently used in threat hunting to identify command-and-control callbacks, automation loops, and persistent outbound communication. Rather than inspecting packets, analysts rely on metadata types that describe periodicity and consistency.

Use these fields to evaluate duration, frequency, and directional volume. Then pivot to DNS, HTTP, or SSL/TLS metadata for deeper behavioral context during metadata forensics.

Stop hunting for the “what” behind network detections

Beaconing is only one behavioral signal. When suspicious network metadata triggers, analysts still need to understand which endpoint process or identity initiated it. Without that linkage, investigations stall.

See endpoint process correlation

DCE-RPC metadata fields and remote procedure call attributes

DCE-RPC metadata captures remote procedure call behavior commonly associated with Windows administration and service interaction. These fields encode domain context, endpoint resolution, invoked operations, username attribution, and request/response timing.

In threat hunting, DCE-RPC metadata helps surface anomalous remote execution sequences and privilege use patterns without requiring endpoint logs.

Use operation names and username/host context to distinguish routine administrative workflows from lateral movement activity during metadata forensics.

DHCP metadata fields and network configuration attributes

DHCP metadata records dynamic addressing and configuration assignments that place devices onto the network. These metadata types link assigned IPs to MAC addresses and hostnames while recording lease duration and DHCP/DNS server attribution.

Because IP churn complicates investigation, DHCP records provide essential metadata enrichment for maintaining attribution continuity.

Use DHCP fields to stabilize investigations when IP addresses change, anchoring identity to device-level attributes rather than ephemeral addressing.

DNS metadata fields and query response attributes

DNS metadata represents domain resolution behavior, including query intent, recursion handling, response codes, truncation flags, TTL values, and record counts.

DNS network metadata is central to threat hunting because it exposes staging infrastructure, domain fluxing, reconnaissance, and failed callback attempts without payload inspection.

DNS metadata enables visibility into:

• Which domains were queried and by whom
  
• Whether recursion was requested or available
  
• How authoritative responses were returned
  
• What response codes and TTL values were observed

Use DNS metadata forensics to interpret intent and outcome, what was queried, what was returned, and whether resolution failed, then pivot into TLS or HTTP metadata to extend analysis.

HTTP metadata fields and web session attributes

HTTP metadata summarizes web-layer behavior without storing full payloads. These fields capture header-derived context, methods, URIs, proxy forwarding indicators, fingerprinting attributes, and directional byte/packet metrics.

In network metadata investigations, HTTP fields provide application-layer context for threat hunting, including suspicious file transfers, scripted callbacks, and anomalous header structures.

Use HTTP metadata to reconstruct web behavior, then correlate with DNS and TLS metadata types to confirm destination identity and encryption characteristics.

iSession connectivity metadata and session-level network attributes

iSession metadata defines the normalized session model used across protocols. It captures connection state, directional confidence, timing markers, fingerprinting variants, VLAN context, and directional byte/packet counts.

This session-layer abstraction enables scalable metadata enrichment by standardizing how network metadata is represented, regardless of protocol.

Treat iSession as the pivot spine during threat hunting. It provides stable session continuity across protocol, authentication, and detection metadata types.

Connection state values and TCP session lifecycle indicators

Connection state values encode how a session progressed, established, rejected, reset, half-open, or incomplete. These indicators are behavioral metadata types that reveal scanning, probing, unstable communication, or aborted sessions.

Use lifecycle states alongside timing and volume fields to prioritize reconnaissance patterns during metadata forensics.

Kerberos metadata fields and authentication ticket attributes

Kerberos metadata captures ticket issuance, authentication type, privilege scoring, cipher negotiation, and success/error states. These identity-layer metadata types are essential for detecting credential abuse and privilege escalation.

Kerberos metadata enables visibility into:

• Account and service privilege levels (low, medium, high)
  
• Ticket request and response types (AS, TGT)
  
• Encryption cipher usage and negotiation
  
• Authentication success and error conditions

Use privilege categories and request types to focus threat hunting on high-impact accounts and services, then pivot to LDAP or session telemetry for validation.

LDAP metadata fields and directory query attributes

LDAP metadata summarizes directory search and bind behavior, including query scope, attribute selection, result counts, and error conditions.

Directory metadata forensics is particularly useful for identifying enumeration preceding authentication abuse.

Use result volume and error patterns to distinguish routine lookups from large-scale discovery during threat hunting workflows.

Match metadata fields and alert signature attributes

Match metadata represents evaluated detection output rather than raw telemetry. These metadata types describe signature identity, severity, revision state, deployment scope, and packet context.

This layer reflects how network metadata was interpreted by detection logic.

Use match metadata to understand why a detection triggered, then pivot back into underlying protocol and session metadata for full reconstruction.

NTLM metadata fields and authentication response attributes

NTLM metadata captures authentication attempts and outcomes, including host, domain, username, status code, and success state.

In environments where NTLM remains active, these metadata types are important for identifying fallback authentication abuse.

Use repeated failures or anomalous success patterns as threat hunting signals, then correlate forward into SMB or RDP metadata.

RDP metadata fields and remote desktop session attributes

RDP metadata captures interactive remote session attributes including client identity, versioning, display characteristics, and encryption indicators.

These metadata types support investigation of administrative access patterns without decrypting content.

Baseline expected remote access patterns and flag deviations during metadata forensics.

RADIUS metadata fields and authentication accounting attributes

RADIUS metadata records access control authentication and accounting behavior, including session identifiers, duration, packet/byte counters, addressing, and policy markers.

These network metadata types help trace remote access paths through VPN, NAC, or wireless systems.

Use accounting and NAS context fields to validate access scope and duration before pivoting into SMB or RDP activity.

Extended RADIUS metadata fields and network access control attributes

Extended RADIUS metadata adds device and enforcement context: NAS identifiers and ports, session and idle timeouts, tunnel endpoints, external source indicators, reply timing, and whether sensitive fields (like password) were observed. These fields help interpret how access decisions were implemented.

Use NAS and tunnel context to pinpoint where access was granted, what service was requested, and how long it persisted, especially useful when tracing remote access paths into internal SMB/RDP activity.

SMB file metadata fields and file operation attributes

SMB file metadata captures file-level operations including creation, rename, delete-on-close behavior, path context, SMB version, and user attribution.

These metadata types are critical for ransomware and lateral staging investigations.

Use file action and rename patterns to identify destructive behavior during threat hunting.

SMB mapping metadata fields and share connection attributes

SMB mapping metadata captures tree connections and share access prior to file interaction.

This layer provides metadata enrichment by linking user identity to share access context.

Use mapping events to establish access lineage before analyzing file-level operations.

SMTP metadata fields and email header attributes

SMTP metadata captures mail header attributes and authentication results including SPF, DKIM, DMARC, TLS usage, and originating IP. Email-related network metadata supports threat hunting for phishing infrastructure and spoofed sender behavior.

Use authentication results and relay chain metadata for forensic validation of sender legitimacy.

SSH metadata fields and encrypted session negotiation attributes

SSH metadata captures negotiation details including client/server versions, key exchange, cipher selection, MAC algorithm, and fingerprinting hashes. These metadata types support identification of anomalous administrative tooling and unauthorized remote shell behavior.

Use algorithm and fingerprint fields to baseline expected administrative tooling and identify unusual clients or negotiation patterns, then pivot to session connectivity to understand duration, direction, and volume for the same SSH session.

SSL/TLS metadata fields and encrypted session attributes

SSL/TLS metadata captures handshake negotiation and certificate exchange characteristics for encrypted sessions. The fields below include protocol versions, chosen cipher suite, curve parameters, client/server extensions, issuer/subject identifiers, SNI, and JA3/JA4 fingerprints, plus establishment status.

Use TLS fingerprints and SNI/certificate context to identify client/server implementations and destination identity, then pivot to X.509 to inspect certificate properties and SAN coverage for deeper trust analysis.

X.509 certificate metadata fields and digital certificate attributes

X.509 metadata records certificate identity and trust characteristics including subject/issuer composition, validity windows, SAN values, key length, signature algorithm, and JA4X fingerprinting. These metadata types support certificate-based metadata forensics and detection of suspicious infrastructure.

Use X.509 attributes to evaluate trust posture and reuse patterns, then correlate back to TLS and DNS metadata to complete the investigative chain.