Skip to content
  • There are no suggestions because the search field is empty.

RSA NetWitness® Suite Unified Data Model Discontinued Concepts

List of Discontinued Concepts 

The following table lists all the keys or concepts that have been discontinued. For backward compatibility of existing analytical content and analysts used to these keys, we will continue to use these keys. The discontinued keys will be removed from the default Content, Index-concentrator.xml and Table-map.xml files in future releases. RSA advises that you start using the new Meta keys going forward.

  • Discontinued Meta Key: ip.addr
  • Replaced by Meta key: alias.ip

  • Discontinued Meta Key: ipv6.addr
  • Replaced by Meta key: alias.ipv6

  • Discontinued Meta Key: ip.srcport
  • Replaced by Meta key: port.src

  • Discontinued Meta Key: ip.dstport
  • Replaced by Meta key: port.dst

  • Discontinued Meta Key: stransaddr
  • Replaced by Meta key: ip.trans.src

  • Discontinued Meta Key: dtransaddr
  • Replaced by Meta key: ip.trans.dst

  • Discontinued Meta Key: stransport
  • Replaced by Meta key: port.trans.src

  • Discontinued Meta Key: dtransport
  • Replaced by Meta key: port.trans.dst

  • Discontinued Meta Key: network.port
  • Replaced by Meta key: port

  • Discontinued Meta Key: ipv6.proto
  • Replaced by Meta key: ip.proto

  • Discontinued Meta Key: privilege
  • Replaced by Meta key: permissions

  • Discontinued Meta Key: username
  • Replaced by Meta key: user

  • Discontinued Meta Key: orig_ip
  • Replaced by Meta key: ip.orig, ipv6.orig or host.orig based on usage

  • Discontinued Meta Key: sdomain
  • Replaced by Meta key: domain.src

  • Discontinued Meta Key: ddomain
  • Replaced by Meta key: domain.dst

  • Discontinued Meta Key: ad.computer.src
  • Replaced by Meta key: host.src

  • Discontinued Meta Key: ad.computer.dst
  • Replaced by Meta key: host.dst

  • Discontinued Meta Key: ad.domain.src
  • Replaced by Meta key: domain.src

  • Discontinued Meta Key: ad.domain.dst
  • Replaced by Meta key: domain.dst

  • Discontinued Meta Key: ad.username.src
  • Replaced by Meta key: user.src

  • Discontinued Meta Key: ad.username.dst
  • Replaced by Meta key: user.dst

  • Discontinued Meta Key: ssl⋅ca
  • Replaced by Meta key: cert⋅ca

  • Discontinued Meta Key: ssl.checksum
  • Replaced by Meta key: cert.checksum

  • Discontinued Meta Key: ssl.common
  • Replaced by Meta key: cert.common

  • Discontinued Meta Key: ssl.subject
  • Replaced by Meta key: cert.subject

  • Discontinued Meta Key: ssl.ver.src
  • Replaced by Meta key: version

  • Discontinued Meta Key: ssl.ver.dst
  • Replaced by Meta key: version

  • Discontinued Meta Key: risk.warning
  • Replaced by Meta key: New Hunting Model (inv.*, ioc, boc, eoc, analysis.*)

  • Discontinued Meta Key: risk⋅info
  • Replaced by Meta key: New Hunting Model (inv.*, ioc, boc, eoc, analysis.*)

  • Discontinued Meta Key: risk⋅suspicious
  • Replaced by Meta key: New Hunting Model (inv.*, ioc, boc, eoc, analysis.*)

  • Discontinued Meta Key: alert⋅id
  • Replaced by Meta key: New Hunting Model (inv.*, ioc, boc, eoc, analysis.*)

  • Discontinued Meta Key: site⋅cat
  • Replaced by Meta key: category

  • Discontinued Meta Key: event.class
  • Replaced by Meta key: Discontinued, no replacement

  • Discontinued Meta Key: paddr
  • Replaced by Meta key: Discontinued, no replacement

  • Discontinued Meta Key: process.time
  • Replaced by Meta key: duration.time

  • Discontinued Meta Key: parent.pid
  • Replaced by Meta key: process.id.src

  • Discontinued Meta Key: child.pid
  • Replaced by Meta key: process⋅id

  • Discontinued Meta Key: eth.host
  • Replaced by Meta key: alias.mac

  • Discontinued Meta Key: tcp.srcport
  • Replaced by Meta key: port.src

  • Discontinued Meta Key: udp.srcport
  • Replaced by Meta key: port.src

  • Discontinued Meta Key: tcp.dstport
  • Replaced by Meta key: port.dst

  • Discontinued Meta Key: udp.dstport
  • Replaced by Meta key: port.dst