source.zeeklogs.js

'use strict';

const WISESource = require('./wiseSource.js');

//////////////////////////////////////////////////////////////////////////////////
// Arkime WISE Data Source definition for Malcolm data sources
//
// Part of Malcolm (https://github.com/idaholab/malcolm)
//
// Data may be populated with Malcolm's Logstash filters:
//   (https://github.com/idaholab/Malcolm/tree/main/logstash/pipelines)
//
// Copyright (c) 2024 Battelle Energy Alliance, LLC.  All rights reserved.
// see https://raw.githubusercontent.com/idaholab/Malcolm/main/LICENSE.txt
//////////////////////////////////////////////////////////////////////////////////

class MalcolmSource extends WISESource {
  // ----------------------------------------------------------------------------
  constructor(api, section) {
    super(api, section, { dontCache: true });

    this.api.addSource('malcolm', this, []);

    // there are several files where the definitions of fields live: make sure to keep them in sync
    // - source.malcolm.js (this file)
    // - Arkime's config.ini
    // - Malcolm's Opensearch malcolm_template.json

    // todo: look at expressions for things that have parents (tunnelling, parent files, etc.)
    // todo: look at IP types and use ipPrint?

    // add right-clicks
    var allFields = [
      "client.bytes",
      "client.domain",
      "destination.as.full",
      "destination.bytes",
      "destination.device.cluster",
      "destination.device.device_type",
      "destination.device.id",
      "destination.device.manufacturer",
      "destination.device.name",
      "destination.device.role",
      "destination.device.service",
      "destination.device.site",
      "destination.device.url",
      "destination.domain",
      "destination.geo.city_name",
      "destination.geo.country_iso_code",
      "destination.geo.country_name",
      "destination.geo.ip",
      "destination.ip",
      "destination.ip_reverse_dns",
      "destination.mac",
      "destination.oui",
      "destination.packets",
      "destination.port",
      "destination.segment.id",
      "destination.segment.name",
      "destination.segment.site",
      "destination.segment.tenant",
      "destination.segment.url",
      "dns.answers.class",
      "dns.answers.data",
      "dns.answers.name",
      "dns.answers.ttl",
      "dns.answers.type",
      "dns.header_flags",
      "dns.id",
      "dns.op_code",
      "dns.question.class",
      "dns.question.name",
      "dns.question.type",
      "dns.resolved_ip",
      "dns.response_code",
      "dns.type",
      "ecs.version",
      "event.action",
      "event.category",
      "event.dataset",
      "event.duration",
      "event.end",
      "event.freq_score_v1",
      "event.freq_score_v2",
      "event.hash",
      "event.hits",
      "event.id",
      "event.ingested",
      "event.kind",
      "event.module",
      "event.outcome",
      "event.provider",
      "event.result",
      "event.risk_score",
      "event.risk_score_norm",
      "event.severity",
      "event.severity_tags",
      "event.start",
      "file.accessed",
      "file.created",
      "file.ctime",
      "file.directory",
      "file.extension",
      "file.hash.md5",
      "file.hash.sha1",
      "file.hash.sha256",
      "file.mime_type",
      "file.mtime",
      "file.name",
      "file.path",
      "file.size",
      "file.source",
      "file.type",
      "file.uid",
      "host.name",
      "http.request.body.bytes",
      "http.request.method",
      "http.request.mime_type",
      "http.request.referrer",
      "http.response.body.bytes",
      "http.response.mime_type",
      "http.response.status_code",
      "http.version",
      "ip.protocol",
      "mac.dst",
      "mac.src",
      "network.application",
      "network.bytes",
      "network.community_id",
      "network.direction",
      "network.iana_number",
      "network.inner.vlan.id",
      "network.is_orig",
      "network.name",
      "network.packets",
      "network.protocol",
      "network.protocol_version",
      "network.transport",
      "network.type",
      "network.vlan.id",
      "node",
      "oui.dst",
      "oui.src",
      "protocols",
      "related.device_id",
      "related.device_name",
      "related.device_type",
      "related.hash",
      "related.hosts",
      "related.ip",
      "related.mac",
      "related.manufacturer",
      "related.oui",
      "related.password",
      "related.role",
      "related.service",
      "related.site",
      "related.user",
      "rootId",
      "rule.author",
      "rule.category",
      "rule.description",
      "rule.id",
      "rule.license",
      "rule.name",
      "rule.reference",
      "server.bytes",
      "server.domain",
      "source.as.full",
      "source.bytes",
      "source.device.cluster",
      "source.device.device_type",
      "source.device.id",
      "source.device.manufacturer",
      "source.device.name",
      "source.device.role",
      "source.device.service",
      "source.device.site",
      "source.device.url",
      "source.geo.city_name",
      "source.geo.country_iso_code",
      "source.geo.country_name",
      "source.geo.ip",
      "source.ip",
      "source.ip_reverse_dns",
      "source.mac",
      "source.nat.ip",
      "source.nat.port",
      "source.oui",
      "source.packets",
      "source.port",
      "source.segment.id",
      "source.segment.name",
      "source.segment.site",
      "source.segment.tenant",
      "source.segment.url",
      "suricata.action",
      "suricata.alert.action",
      "suricata.alert.metadata.created_at",
      "suricata.alert.metadata.malware_family",
      "suricata.alert.metadata.performance_impact",
      "suricata.alert.metadata.signature_severity",
      "suricata.alert.metadata.updated_at",
      "suricata.alert.rev",
      "suricata.alert.severity",
      "suricata.anomaly.app_proto",
      "suricata.anomaly.code",
      "suricata.anomaly.event",
      "suricata.anomaly.event_no",
      "suricata.anomaly.layer",
      "suricata.anomaly.type",
      "suricata.app_proto_expected",
      "suricata.app_proto_orig",
      "suricata.app_proto_tc",
      "suricata.app_proto_ts",
      "suricata.category",
      "suricata.dhcp.assigned_ip",
      "suricata.dhcp.client_id",
      "suricata.dhcp.client_ip",
      "suricata.dhcp.client_mac",
      "suricata.dhcp.dhcp_type",
      "suricata.dhcp.dns_servers",
      "suricata.dhcp.hostname",
      "suricata.dhcp.id",
      "suricata.dhcp.lease_time",
      "suricata.dhcp.next_server_ip",
      "suricata.dhcp.params",
      "suricata.dhcp.rebinding_time",
      "suricata.dhcp.relay_ip",
      "suricata.dhcp.renewal_time",
      "suricata.dhcp.requested_ip",
      "suricata.dhcp.routers",
      "suricata.dhcp.subnet_mask",
      "suricata.dhcp.type",
      "suricata.dnp3.application.complete",
      "suricata.dnp3.application.control.con",
      "suricata.dnp3.application.control.fin",
      "suricata.dnp3.application.control.fir",
      "suricata.dnp3.application.control.sequence",
      "suricata.dnp3.application.control.uns",
      "suricata.dnp3.application.function_code",
      "suricata.dnp3.application.objects.count",
      "suricata.dnp3.application.objects.group",
      "suricata.dnp3.application.objects.points.authentication_key",
      "suricata.dnp3.application.objects.points.block_number",
      "suricata.dnp3.application.objects.points.challenge_data_len",
      "suricata.dnp3.application.objects.points.chatter_filter",
      "suricata.dnp3.application.objects.points.comm_lost",
      "suricata.dnp3.application.objects.points.count",
      "suricata.dnp3.application.objects.points.cr",
      "suricata.dnp3.application.objects.points.created",
      "suricata.dnp3.application.objects.points.data.mac_value",
      "suricata.dnp3.application.objects.points.data.wrapped_key_data",
      "suricata.dnp3.application.objects.points.delay_ms",
      "suricata.dnp3.application.objects.points.file_data",
      "suricata.dnp3.application.objects.points.file_handle",
      "suricata.dnp3.application.objects.points.file_size",
      "suricata.dnp3.application.objects.points.filename",
      "suricata.dnp3.application.objects.points.filename_offset",
      "suricata.dnp3.application.objects.points.filename_size",
      "suricata.dnp3.application.objects.points.index",
      "suricata.dnp3.application.objects.points.key_status",
      "suricata.dnp3.application.objects.points.key_wrap_alg",
      "suricata.dnp3.application.objects.points.ksq",
      "suricata.dnp3.application.objects.points.local_forced",
      "suricata.dnp3.application.objects.points.mal",
      "suricata.dnp3.application.objects.points.maximum_block_size",
      "suricata.dnp3.application.objects.points.offtime",
      "suricata.dnp3.application.objects.points.online",
      "suricata.dnp3.application.objects.points.ontime",
      "suricata.dnp3.application.objects.points.op_type",
      "suricata.dnp3.application.objects.points.operational_mode",
      "suricata.dnp3.application.objects.points.optional_text",
      "suricata.dnp3.application.objects.points.over_range",
      "suricata.dnp3.application.objects.points.permissions",
      "suricata.dnp3.application.objects.points.prefix",
      "suricata.dnp3.application.objects.points.qu",
      "suricata.dnp3.application.objects.points.reference_err",
      "suricata.dnp3.application.objects.points.remote_forced",
      "suricata.dnp3.application.objects.points.request_id",
      "suricata.dnp3.application.objects.points.reserved",
      "suricata.dnp3.application.objects.points.reserved0",
      "suricata.dnp3.application.objects.points.reserved1",
      "suricata.dnp3.application.objects.points.restart",
      "suricata.dnp3.application.objects.points.size",
      "suricata.dnp3.application.objects.points.state",
      "suricata.dnp3.application.objects.points.status_code",
      "suricata.dnp3.application.objects.points.tcc",
      "suricata.dnp3.application.objects.points.timestamp",
      "suricata.dnp3.application.objects.points.user_number",
      "suricata.dnp3.application.objects.points.usr",
      "suricata.dnp3.application.objects.points.value",
      "suricata.dnp3.application.objects.prefix_code",
      "suricata.dnp3.application.objects.qualifier",
      "suricata.dnp3.application.objects.range_code",
      "suricata.dnp3.application.objects.start",
      "suricata.dnp3.application.objects.stop",
      "suricata.dnp3.application.objects.variation",
      "suricata.dnp3.control.dir",
      "suricata.dnp3.control.fcb",
      "suricata.dnp3.control.fcv",
      "suricata.dnp3.control.function_code",
      "suricata.dnp3.control.pri",
      "suricata.dnp3.dst",
      "suricata.dnp3.iin.indicators",
      "suricata.dnp3.request.application.complete",
      "suricata.dnp3.request.application.control.con",
      "suricata.dnp3.request.application.control.fin",
      "suricata.dnp3.request.application.control.fir",
      "suricata.dnp3.request.application.control.sequence",
      "suricata.dnp3.request.application.control.uns",
      "suricata.dnp3.request.application.function_code",
      "suricata.dnp3.request.application.objects.count",
      "suricata.dnp3.request.application.objects.group",
      "suricata.dnp3.request.application.objects.points.authentication_key",
      "suricata.dnp3.request.application.objects.points.count",
      "suricata.dnp3.request.application.objects.points.cr",
      "suricata.dnp3.request.application.objects.points.created",
      "suricata.dnp3.request.application.objects.points.file_size",
      "suricata.dnp3.request.application.objects.points.filename",
      "suricata.dnp3.request.application.objects.points.filename_offset",
      "suricata.dnp3.request.application.objects.points.filename_size",
      "suricata.dnp3.request.application.objects.points.index",
      "suricata.dnp3.request.application.objects.points.maximum_block_size",
      "suricata.dnp3.request.application.objects.points.offtime",
      "suricata.dnp3.request.application.objects.points.ontime",
      "suricata.dnp3.request.application.objects.points.op_type",
      "suricata.dnp3.request.application.objects.points.operational_mode",
      "suricata.dnp3.request.application.objects.points.permissions",
      "suricata.dnp3.request.application.objects.points.prefix",
      "suricata.dnp3.request.application.objects.points.qu",
      "suricata.dnp3.request.application.objects.points.request_id",
      "suricata.dnp3.request.application.objects.points.reserved",
      "suricata.dnp3.request.application.objects.points.size",
      "suricata.dnp3.request.application.objects.points.status_code",
      "suricata.dnp3.request.application.objects.points.tcc",
      "suricata.dnp3.request.application.objects.points.timestamp",
      "suricata.dnp3.request.application.objects.points.user_number",
      "suricata.dnp3.request.application.objects.prefix_code",
      "suricata.dnp3.request.application.objects.qualifier",
      "suricata.dnp3.request.application.objects.range_code",
      "suricata.dnp3.request.application.objects.start",
      "suricata.dnp3.request.application.objects.stop",
      "suricata.dnp3.request.application.objects.variation",
      "suricata.dnp3.request.control.dir",
      "suricata.dnp3.request.control.fcb",
      "suricata.dnp3.request.control.fcv",
      "suricata.dnp3.request.control.function_code",
      "suricata.dnp3.request.control.pri",
      "suricata.dnp3.request.dst",
      "suricata.dnp3.request.src",
      "suricata.dnp3.request.type",
      "suricata.dnp3.response.application.complete",
      "suricata.dnp3.response.application.control.con",
      "suricata.dnp3.response.application.control.fin",
      "suricata.dnp3.response.application.control.fir",
      "suricata.dnp3.response.application.control.sequence",
      "suricata.dnp3.response.application.control.uns",
      "suricata.dnp3.response.application.function_code",
      "suricata.dnp3.response.application.objects.count",
      "suricata.dnp3.response.application.objects.group",
      "suricata.dnp3.response.application.objects.points.challenge_data_len",
      "suricata.dnp3.response.application.objects.points.chatter_filter",
      "suricata.dnp3.response.application.objects.points.comm_lost",
      "suricata.dnp3.response.application.objects.points.count",
      "suricata.dnp3.response.application.objects.points.cr",
      "suricata.dnp3.response.application.objects.points.data.challenge_data",
      "suricata.dnp3.response.application.objects.points.data.mac_value",
      "suricata.dnp3.response.application.objects.points.delay_ms",
      "suricata.dnp3.response.application.objects.points.file_handle",
      "suricata.dnp3.response.application.objects.points.file_size",
      "suricata.dnp3.response.application.objects.points.index",
      "suricata.dnp3.response.application.objects.points.key_status",
      "suricata.dnp3.response.application.objects.points.key_wrap_alg",
      "suricata.dnp3.response.application.objects.points.ksq",
      "suricata.dnp3.response.application.objects.points.local_forced",
      "suricata.dnp3.response.application.objects.points.mal",
      "suricata.dnp3.response.application.objects.points.maximum_block_size",
      "suricata.dnp3.response.application.objects.points.offtime",
      "suricata.dnp3.response.application.objects.points.online",
      "suricata.dnp3.response.application.objects.points.ontime",
      "suricata.dnp3.response.application.objects.points.op_type",
      "suricata.dnp3.response.application.objects.points.optional_text",
      "suricata.dnp3.response.application.objects.points.over_range",
      "suricata.dnp3.response.application.objects.points.prefix",
      "suricata.dnp3.response.application.objects.points.qu",
      "suricata.dnp3.response.application.objects.points.reference_err",
      "suricata.dnp3.response.application.objects.points.remote_forced",
      "suricata.dnp3.response.application.objects.points.request_id",
      "suricata.dnp3.response.application.objects.points.reserved",
      "suricata.dnp3.response.application.objects.points.reserved0",
      "suricata.dnp3.response.application.objects.points.reserved1",
      "suricata.dnp3.response.application.objects.points.restart",
      "suricata.dnp3.response.application.objects.points.size",
      "suricata.dnp3.response.application.objects.points.state",
      "suricata.dnp3.response.application.objects.points.status_code",
      "suricata.dnp3.response.application.objects.points.tcc",
      "suricata.dnp3.response.application.objects.points.user_number",
      "suricata.dnp3.response.application.objects.points.value",
      "suricata.dnp3.response.application.objects.prefix_code",
      "suricata.dnp3.response.application.objects.qualifier",
      "suricata.dnp3.response.application.objects.range_code",
      "suricata.dnp3.response.application.objects.start",
      "suricata.dnp3.response.application.objects.stop",
      "suricata.dnp3.response.application.objects.variation",
      "suricata.dnp3.response.control.dir",
      "suricata.dnp3.response.control.fcb",
      "suricata.dnp3.response.control.fcv",
      "suricata.dnp3.response.control.function_code",
      "suricata.dnp3.response.control.pri",
      "suricata.dnp3.response.dst",
      "suricata.dnp3.response.iin.indicators",
      "suricata.dnp3.response.src",
      "suricata.dnp3.response.type",
      "suricata.dnp3.src",
      "suricata.dnp3.type",
      "suricata.dns.aa",
      "suricata.dns.answer.aa",
      "suricata.dns.answer.authorities.rrname",
      "suricata.dns.answer.authorities.rrtype",
      "suricata.dns.answer.authorities.ttl",
      "suricata.dns.answer.flags",
      "suricata.dns.answer.id",
      "suricata.dns.answer.qr",
      "suricata.dns.answer.ra",
      "suricata.dns.answer.rcode",
      "suricata.dns.answer.rrname",
      "suricata.dns.answer.rrtype",
      "suricata.dns.answer.type",
      "suricata.dns.answer.version",
      "suricata.dns.answers.rdata",
      "suricata.dns.answers.rrname",
      "suricata.dns.answers.rrtype",
      "suricata.dns.answers.ttl",
      "suricata.dns.authorities.rdata",
      "suricata.dns.authorities.rrname",
      "suricata.dns.authorities.rrtype",
      "suricata.dns.authorities.ttl",
      "suricata.dns.flags",
      "suricata.dns.qr",
      "suricata.dns.query.id",
      "suricata.dns.query.rrname",
      "suricata.dns.query.rrtype",
      "suricata.dns.query.tx_id",
      "suricata.dns.query.type",
      "suricata.dns.ra",
      "suricata.dns.rd",
      "suricata.dns.rrname",
      "suricata.dns.rrtype",
      "suricata.dns.tc",
      "suricata.dns.tx_id",
      "suricata.dns.version",
      "suricata.email.attachment",
      "suricata.email.body_md5",
      "suricata.email.cc",
      "suricata.email.from",
      "suricata.email.status",
      "suricata.email.subject_md5",
      "suricata.email.to",
      "suricata.fileinfo.end",
      "suricata.fileinfo.file_id",
      "suricata.fileinfo.filename",
      "suricata.fileinfo.gaps",
      "suricata.fileinfo.magic",
      "suricata.fileinfo.md5",
      "suricata.fileinfo.sha1",
      "suricata.fileinfo.sha256",
      "suricata.fileinfo.sid",
      "suricata.fileinfo.size",
      "suricata.fileinfo.start",
      "suricata.fileinfo.state",
      "suricata.fileinfo.tx_id",
      "suricata.files.end",
      "suricata.files.filename",
      "suricata.files.gaps",
      "suricata.files.size",
      "suricata.files.start",
      "suricata.files.state",
      "suricata.files.tx_id",
      "suricata.flow.age",
      "suricata.flow.alerted",
      "suricata.flow.bytes_toclient",
      "suricata.flow.bytes_toserver",
      "suricata.flow.emergency",
      "suricata.flow.end",
      "suricata.flow.pkts_toclient",
      "suricata.flow.pkts_toserver",
      "suricata.flow.reason",
      "suricata.flow.start",
      "suricata.flow.state",
      "suricata.flow_id",
      "suricata.ftp.command",
      "suricata.ftp.command_data",
      "suricata.ftp.completion_code",
      "suricata.ftp.dynamic_port",
      "suricata.ftp.reply",
      "suricata.ftp.reply_received",
      "suricata.gid",
      "suricata.http.content_range.end",
      "suricata.http.content_range.raw",
      "suricata.http.content_range.size",
      "suricata.http.content_range.start",
      "suricata.http.hostname",
      "suricata.http.http_content_type",
      "suricata.http.http_method",
      "suricata.http.http_port",
      "suricata.http.http_refer",
      "suricata.http.http_request_body",
      "suricata.http.http_request_body_printable",
      "suricata.http.http_response_body",
      "suricata.http.http_response_body_printable",
      "suricata.http.http_user_agent",
      "suricata.http.length",
      "suricata.http.protocol",
      "suricata.http.redirect",
      "suricata.http.request_headers.name",
      "suricata.http.request_headers.value",
      "suricata.http.response_headers.name",
      "suricata.http.response_headers.value",
      "suricata.http.status",
      "suricata.http.url",
      "suricata.icmp_code",
      "suricata.icmp_type",
      "suricata.ikev2.alg_auth",
      "suricata.ikev2.alg_dh",
      "suricata.ikev2.alg_enc",
      "suricata.ikev2.alg_esn",
      "suricata.ikev2.alg_prf",
      "suricata.ikev2.errors",
      "suricata.ikev2.exchange_type",
      "suricata.ikev2.init_spi",
      "suricata.ikev2.message_id",
      "suricata.ikev2.notify",
      "suricata.ikev2.payload",
      "suricata.ikev2.resp_spi",
      "suricata.ikev2.role",
      "suricata.ikev2.version_major",
      "suricata.ikev2.version_minor",
      "suricata.in_iface",
      "suricata.krb5.cname",
      "suricata.krb5.encryption",
      "suricata.krb5.error_code",
      "suricata.krb5.failed_request",
      "suricata.krb5.msg_type",
      "suricata.krb5.realm",
      "suricata.krb5.sname",
      "suricata.krb5.weak_encryption",
      "suricata.metadata.flowbits",
      "suricata.netflow.age",
      "suricata.netflow.bytes",
      "suricata.netflow.end",
      "suricata.netflow.max_ttl",
      "suricata.netflow.min_ttl",
      "suricata.netflow.pkts",
      "suricata.netflow.start",
      "suricata.nfs.file_tx",
      "suricata.nfs.filename",
      "suricata.nfs.hhash",
      "suricata.nfs.id",
      "suricata.nfs.procedure",
      "suricata.nfs.rename.from",
      "suricata.nfs.rename.to",
      "suricata.nfs.status",
      "suricata.nfs.type",
      "suricata.nfs.version",
      "suricata.pcap_cnt",
      "suricata.pcap_filename",
      "suricata.rdp.channels",
      "suricata.rdp.client.build",
      "suricata.rdp.client.capabilities",
      "suricata.rdp.client.client_name",
      "suricata.rdp.client.color_depth",
      "suricata.rdp.client.connection_hint",
      "suricata.rdp.client.desktop_height",
      "suricata.rdp.client.desktop_width",
      "suricata.rdp.client.function_keys",
      "suricata.rdp.client.id",
      "suricata.rdp.client.keyboard_layout",
      "suricata.rdp.client.keyboard_type",
      "suricata.rdp.client.product_id",
      "suricata.rdp.client.version",
      "suricata.rdp.cookie",
      "suricata.rdp.error_code",
      "suricata.rdp.event_type",
      "suricata.rdp.protocol",
      "suricata.rdp.reason",
      "suricata.rdp.server_supports",
      "suricata.rdp.tx_id",
      "suricata.rdp.x509_serials",
      "suricata.response_icmp_code",
      "suricata.response_icmp_type",
      "suricata.rpc.auth_type",
      "suricata.rpc.creds.gid",
      "suricata.rpc.creds.machine_name",
      "suricata.rpc.creds.uid",
      "suricata.rpc.status",
      "suricata.rpc.xid",
      "suricata.severity",
      "suricata.signature",
      "suricata.sip.code",
      "suricata.sip.method",
      "suricata.sip.reason",
      "suricata.sip.request_line",
      "suricata.sip.response_line",
      "suricata.sip.uri",
      "suricata.sip.version",
      "suricata.smb.access",
      "suricata.smb.accessed",
      "suricata.smb.changed",
      "suricata.smb.client_dialects",
      "suricata.smb.client_dialects[]",
      "suricata.smb.client_guid",
      "suricata.smb.command",
      "suricata.smb.created",
      "suricata.smb.dcerpc.call_id",
      "suricata.smb.dcerpc.interfaces.ack_reason",
      "suricata.smb.dcerpc.interfaces.ack_result",
      "suricata.smb.dcerpc.interfaces.uuid",
      "suricata.smb.dcerpc.interfaces.version",
      "suricata.smb.dcerpc.opnum",
      "suricata.smb.dcerpc.req.frag_cnt",
      "suricata.smb.dcerpc.req.stub_data_size",
      "suricata.smb.dcerpc.request",
      "suricata.smb.dcerpc.res.frag_cnt",
      "suricata.smb.dcerpc.res.stub_data_size",
      "suricata.smb.dcerpc.response",
      "suricata.smb.dialect",
      "suricata.smb.directory",
      "suricata.smb.disposition",
      "suricata.smb.filename",
      "suricata.smb.fuid",
      "suricata.smb.function",
      "suricata.smb.id",
      "suricata.smb.kerberos.realm",
      "suricata.smb.kerberos.snames",
      "suricata.smb.modified",
      "suricata.smb.named_pipe",
      "suricata.smb.ntlmssp.domain",
      "suricata.smb.ntlmssp.host",
      "suricata.smb.ntlmssp.user",
      "suricata.smb.rename.from",
      "suricata.smb.rename.to",
      "suricata.smb.request.native_lm",
      "suricata.smb.request.native_os",
      "suricata.smb.response.native_lm",
      "suricata.smb.response.native_os",
      "suricata.smb.server_guid",
      "suricata.smb.service.request",
      "suricata.smb.service.response",
      "suricata.smb.session_id",
      "suricata.smb.set_info.class",
      "suricata.smb.set_info.info_level",
      "suricata.smb.share",
      "suricata.smb.share_type",
      "suricata.smb.size",
      "suricata.smb.status",
      "suricata.smb.status_code",
      "suricata.smb.tree_id",
      "suricata.smtp.helo",
      "suricata.smtp.mail_from",
      "suricata.smtp.rcpt_to",
      "suricata.snmp.community",
      "suricata.snmp.error",
      "suricata.snmp.pdu_type",
      "suricata.snmp.trap_address",
      "suricata.snmp.trap_oid",
      "suricata.snmp.trap_type",
      "suricata.snmp.usm",
      "suricata.snmp.vars",
      "suricata.snmp.version",
      "suricata.ssh.client.proto_version",
      "suricata.ssh.client.software_version",
      "suricata.ssh.server.proto_version",
      "suricata.ssh.server.software_version",
      "suricata.stream",
      "suricata.tcp.ack",
      "suricata.tcp.cwr",
      "suricata.tcp.ecn",
      "suricata.tcp.fin",
      "suricata.tcp.psh",
      "suricata.tcp.rst",
      "suricata.tcp.state",
      "suricata.tcp.syn",
      "suricata.tcp.tcp_flags",
      "suricata.tcp.tcp_flags_tc",
      "suricata.tcp.tcp_flags_ts",
      "suricata.tcp.urg",
      "suricata.tftp.file",
      "suricata.tftp.mode",
      "suricata.tftp.packet",
      "suricata.timestamp",
      "suricata.tls.fingerprint",
      "suricata.tls.from_proto",
      "suricata.tls.issuerdn",
      "suricata.tls.notafter",
      "suricata.tls.notbefore",
      "suricata.tls.serial",
      "suricata.tls.session_resumed",
      "suricata.tls.sni",
      "suricata.tls.subject",
      "suricata.tls.version",
      "suricata.tunnel.depth",
      "suricata.tunnel.dest_ip",
      "suricata.tunnel.dest_port",
      "suricata.tunnel.proto",
      "suricata.tunnel.src_ip",
      "suricata.tunnel.src_port",
      "suricata.tx_id",
      "tags",
      "threat.framework",
      "threat.tactic.id",
      "threat.tactic.name",
      "threat.tactic.reference",
      "threat.technique.id",
      "threat.technique.name",
      "threat.technique.reference",
      "tls.cipher",
      "tls.client.issuer",
      "tls.client.ja4",
      "tls.client.server_name",
      "tls.client.subject",
      "tls.curve",
      "tls.established",
      "tls.next_protocol",
      "tls.resumed",
      "tls.server.issuer",
      "tls.server.ja4s",
      "tls.server.subject",
      "tls.version",
      "tls.version_protocol",
      "url.domain",
      "url.extension",
      "url.fragment",
      "url.full",
      "url.original",
      "url.password",
      "url.path",
      "url.port",
      "url.query",
      "url.scheme",
      "url.username",
      "user_agent.original",
      "vulnerability.category",
      "vulnerability.description",
      "vulnerability.enumeration",
      "vulnerability.id",
      "vulnerability.reference",
      "vulnerability.scanner.vendor",
      "zeek.bacnet.bvlc_function",
      "zeek.bacnet.instance_number",
      "zeek.bacnet.invoke_id",
      "zeek.bacnet.pdu_service",
      "zeek.bacnet.pdu_type",
      "zeek.bacnet.result_code",
      "zeek.bacnet_device_control.device_state",
      "zeek.bacnet_device_control.result",
      "zeek.bacnet_device_control.result_code",
      "zeek.bacnet_device_control.time_duration",
      "zeek.bacnet_discovery.device_id_number",
      "zeek.bacnet_discovery.device_id_type",
      "zeek.bacnet_discovery.object_name",
      "zeek.bacnet_discovery.object_type",
      "zeek.bacnet_discovery.range",
      "zeek.bacnet_discovery.range_high",
      "zeek.bacnet_discovery.range_low",
      "zeek.bacnet_discovery.vendor",
      "zeek.bacnet_property.array_index",
      "zeek.bacnet_property.object_type",
      "zeek.bacnet_property.property",
      "zeek.bacnet_property.value",
      "zeek.bestguess.category",
      "zeek.bestguess.name",
      "zeek.bsap_ip_header.num_msg",
      "zeek.bsap_ip_header.type_name",
      "zeek.bsap_ip_rdb.app_func_code",
      "zeek.bsap_ip_rdb.func_code",
      "zeek.bsap_ip_rdb.header_size",
      "zeek.bsap_ip_rdb.mes_seq",
      "zeek.bsap_ip_rdb.node_status",
      "zeek.bsap_ip_rdb.res_seq",
      "zeek.bsap_ip_rdb.sequence",
      "zeek.bsap_ip_rdb.variable_count",
      "zeek.bsap_ip_rdb.variables.val",
      "zeek.bsap_ip_rdb.variables.var",
      "zeek.bsap_serial_header.ctl",
      "zeek.bsap_serial_header.dadd",
      "zeek.bsap_serial_header.dfun",
      "zeek.bsap_serial_header.nsb",
      "zeek.bsap_serial_header.sadd",
      "zeek.bsap_serial_header.seq",
      "zeek.bsap_serial_header.ser",
      "zeek.bsap_serial_header.sfun",
      "zeek.bsap_serial_header.type_name",
      "zeek.bsap_serial_rdb.func_code",
      "zeek.bsap_serial_rdb.variable_count",
      "zeek.bsap_serial_rdb.variables.val",
      "zeek.bsap_serial_rdb.variables.var",
      "zeek.bsap_serial_rdb_ext.data",
      "zeek.bsap_serial_rdb_ext.dfun",
      "zeek.bsap_serial_rdb_ext.extfun",
      "zeek.bsap_serial_rdb_ext.nsb",
      "zeek.bsap_serial_rdb_ext.seq",
      "zeek.bsap_serial_rdb_ext.sfun",
      "zeek.cip.attribute_id",
      "zeek.cip.cip_extended_status",
      "zeek.cip.cip_extended_status_code",
      "zeek.cip.cip_sequence_count",
      "zeek.cip.cip_service",
      "zeek.cip.cip_service_code",
      "zeek.cip.cip_status",
      "zeek.cip.cip_status_code",
      "zeek.cip.class_id",
      "zeek.cip.class_name",
      "zeek.cip.direction",
      "zeek.cip.instance_id",
      "zeek.cip.packet_correlation_id",
      "zeek.cip_identity.device_state",
      "zeek.cip_identity.device_status",
      "zeek.cip_identity.device_type_id",
      "zeek.cip_identity.device_type_name",
      "zeek.cip_identity.encapsulation_version",
      "zeek.cip_identity.product_code",
      "zeek.cip_identity.product_name",
      "zeek.cip_identity.revision",
      "zeek.cip_identity.serial_number",
      "zeek.cip_identity.socket_address",
      "zeek.cip_identity.socket_address_asn",
      "zeek.cip_identity.socket_address_geo.city_name",
      "zeek.cip_identity.socket_address_geo.country_name",
      "zeek.cip_identity.socket_port",
      "zeek.cip_identity.vendor_id",
      "zeek.cip_identity.vendor_name",
      "zeek.cip_io.connection_id",
      "zeek.cip_io.data_length",
      "zeek.cip_io.io_data",
      "zeek.cip_io.sequence_number",
      "zeek.conn.conn_state",
      "zeek.conn.conn_state_description",
      "zeek.conn.duration",
      "zeek.conn.history",
      "zeek.conn.inner_vlan",
      "zeek.conn.ja4l",
      "zeek.conn.ja4ls",
      "zeek.conn.ja4t",
      "zeek.conn.ja4ts",
      "zeek.conn.local_orig",
      "zeek.conn.local_resp",
      "zeek.conn.missed_bytes",
      "zeek.conn.orig_bytes",
      "zeek.conn.orig_ip_bytes",
      "zeek.conn.orig_pkts",
      "zeek.conn.resp_bytes",
      "zeek.conn.resp_ip_bytes",
      "zeek.conn.resp_pkts",
      "zeek.conn.tunnel_parents",
      "zeek.conn.vlan",
      "zeek.cotp.pdu_code",
      "zeek.cotp.pdu_name",
      "zeek.dce_rpc.endpoint",
      "zeek.dce_rpc.named_pipe",
      "zeek.dce_rpc.operation",
      "zeek.dce_rpc.rtt",
      "zeek.dhcp.assigned_ip",
      "zeek.dhcp.client_fqdn",
      "zeek.dhcp.client_message",
      "zeek.dhcp.client_software",
      "zeek.dhcp.domain",
      "zeek.dhcp.duration",
      "zeek.dhcp.host_name",
      "zeek.dhcp.lease_time",
      "zeek.dhcp.mac",
      "zeek.dhcp.msg_types",
      "zeek.dhcp.requested_ip",
      "zeek.dhcp.server_message",
      "zeek.dhcp.server_software",
      "zeek.dhcp.trans_id",
      "zeek.dnp3.fc_reply",
      "zeek.dnp3.fc_request",
      "zeek.dnp3.iin",
      "zeek.dnp3.iin_flags",
      "zeek.dnp3_control.block_type",
      "zeek.dnp3_control.execute_count",
      "zeek.dnp3_control.function_code",
      "zeek.dnp3_control.index_number",
      "zeek.dnp3_control.off_time",
      "zeek.dnp3_control.on_time",
      "zeek.dnp3_control.operation_type",
      "zeek.dnp3_control.status_code",
      "zeek.dnp3_control.trip_control_code",
      "zeek.dnp3_objects.function_code",
      "zeek.dnp3_objects.object_count",
      "zeek.dnp3_objects.object_type",
      "zeek.dnp3_objects.range_high",
      "zeek.dnp3_objects.range_low",
      "zeek.dns.AA",
      "zeek.dns.answers",
      "zeek.dns.qclass",
      "zeek.dns.qclass_name",
      "zeek.dns.qtype",
      "zeek.dns.qtype_name",
      "zeek.dns.query",
      "zeek.dns.RA",
      "zeek.dns.rcode",
      "zeek.dns.rcode_name",
      "zeek.dns.RD",
      "zeek.dns.rejected",
      "zeek.dns.rtt",
      "zeek.dns.TC",
      "zeek.dns.trans_id",
      "zeek.dns.TTLs",
      "zeek.dns.Z",
      "zeek.dpd.failure_reason",
      "zeek.dpd.service",
      "zeek.ecat_aoe_info.command",
      "zeek.ecat_aoe_info.data",
      "zeek.ecat_aoe_info.orig_port",
      "zeek.ecat_aoe_info.resp_port",
      "zeek.ecat_aoe_info.state",
      "zeek.ecat_arp_info.arp_type",
      "zeek.ecat_arp_info.orig_hw_addr",
      "zeek.ecat_arp_info.orig_proto_addr",
      "zeek.ecat_arp_info.resp_hw_addr",
      "zeek.ecat_arp_info.resp_proto_addr",
      "zeek.ecat_coe_info.dataoffset",
      "zeek.ecat_coe_info.index",
      "zeek.ecat_coe_info.number",
      "zeek.ecat_coe_info.req_resp",
      "zeek.ecat_coe_info.subindex",
      "zeek.ecat_coe_info.type",
      "zeek.ecat_dev_info.build",
      "zeek.ecat_dev_info.dev_type",
      "zeek.ecat_dev_info.dpram",
      "zeek.ecat_dev_info.features",
      "zeek.ecat_dev_info.fmmucnt",
      "zeek.ecat_dev_info.ports",
      "zeek.ecat_dev_info.revision",
      "zeek.ecat_dev_info.server_id",
      "zeek.ecat_dev_info.smcount",
      "zeek.ecat_foe_info.data",
      "zeek.ecat_foe_info.error_code",
      "zeek.ecat_foe_info.filename",
      "zeek.ecat_foe_info.opcode",
      "zeek.ecat_foe_info.packet_num",
      "zeek.ecat_foe_info.reserved",
      "zeek.ecat_log_address.command",
      "zeek.ecat_log_address.data",
      "zeek.ecat_log_address.length",
      "zeek.ecat_log_address.log_addr",
      "zeek.ecat_registers.command",
      "zeek.ecat_registers.data",
      "zeek.ecat_registers.register_addr",
      "zeek.ecat_registers.register_type",
      "zeek.ecat_registers.server_addr",
      "zeek.ecat_soe_info.drive_num",
      "zeek.ecat_soe_info.element",
      "zeek.ecat_soe_info.error",
      "zeek.ecat_soe_info.incomplete",
      "zeek.ecat_soe_info.index",
      "zeek.ecat_soe_info.opcode",
      "zeek.enip.enip_command",
      "zeek.enip.enip_command_code",
      "zeek.enip.enip_status",
      "zeek.enip.length",
      "zeek.enip.options",
      "zeek.enip.sender_context",
      "zeek.enip.session_handle",
      "zeek.files.analyzers",
      "zeek.files.conn_uids",
      "zeek.files.depth",
      "zeek.files.duration",
      "zeek.files.extracted",
      "zeek.files.extracted_cutoff",
      "zeek.files.extracted_size",
      "zeek.files.extracted_uri",
      "zeek.files.filename",
      "zeek.files.ftime",
      "zeek.files.local_orig",
      "zeek.files.md5",
      "zeek.files.mime_type",
      "zeek.files.missing_bytes",
      "zeek.files.overflow_bytes",
      "zeek.files.parent_fuid",
      "zeek.files.rx_hosts",
      "zeek.files.seen_bytes",
      "zeek.files.sha1",
      "zeek.files.sha256",
      "zeek.files.timedout",
      "zeek.files.total_bytes",
      "zeek.files.tx_hosts",
      "zeek.ftp.arg",
      "zeek.ftp.command",
      "zeek.ftp.data_channel.orig_h",
      "zeek.ftp.data_channel.passive",
      "zeek.ftp.data_channel.resp_h",
      "zeek.ftp.data_channel.resp_p",
      "zeek.ftp.file_size",
      "zeek.ftp.mime_type",
      "zeek.ftp.reply_code",
      "zeek.ftp.reply_msg",
      "zeek.fuid",
      "zeek.genisys.crc_calculated",
      "zeek.genisys.crc_transmitted",
      "zeek.genisys.direction",
      "zeek.genisys.header",
      "zeek.genisys.payload.address",
      "zeek.genisys.payload.data",
      "zeek.genisys.server",
      "zeek.ge_srtp.srtp_type",
      "zeek.ge_srtp.sequence_number_1",
      "zeek.ge_srtp.text_length",
      "zeek.ge_srtp.time_seconds",
      "zeek.ge_srtp.time_minutes",
      "zeek.ge_srtp.time_hours",
      "zeek.ge_srtp.sequence_number_2",
      "zeek.ge_srtp.message_type",
      "zeek.ge_srtp.mailbox_source",
      "zeek.ge_srtp.mailbox_destination",
      "zeek.ge_srtp.packet_number",
      "zeek.ge_srtp.total_packet_number",
      "zeek.ge_srtp.service_request_code",
      "zeek.ge_srtp.segment_selector",
      "zeek.ge_srtp.memory_offset",
      "zeek.ge_srtp.data_length",
      "zeek.ge_srtp.status_code",
      "zeek.ge_srtp.minor_status_code",
      "zeek.ge_srtp.data_requested",
      "zeek.ge_srtp.control_program_number",
      "zeek.ge_srtp.current_privilege_level",
      "zeek.ge_srtp.last_sweep_time",
      "zeek.ge_srtp.oversweep_flag",
      "zeek.ge_srtp.constant_sweep_mode",
      "zeek.ge_srtp.plc_fault_entry_last_read",
      "zeek.ge_srtp.io_fault_entry_last_read",
      "zeek.ge_srtp.plc_fault_entry_present",
      "zeek.ge_srtp.io_fault_entry_present",
      "zeek.ge_srtp.programmer_attachment",
      "zeek.ge_srtp.front_panel_enable_switch",
      "zeek.ge_srtp.front_panel_run_switch",
      "zeek.ge_srtp.oem_protected",
      "zeek.ge_srtp.plc_state",
      "zeek.gquic.cyu",
      "zeek.gquic.cyutags",
      "zeek.gquic.server_name",
      "zeek.gquic.tag_count",
      "zeek.gquic.user_agent",
      "zeek.gquic.version",
      "zeek.hart_ip_common_commands.eeprom_control_eeprom_control_code",
      "zeek.hart_ip_common_commands.enter_exit_fixed_analog_channel_mode_analog_channel_number_code",
      "zeek.hart_ip_common_commands.enter_exit_fixed_analog_channel_mode_analog_channel_units_code",
      "zeek.hart_ip_common_commands.enter_exit_fixed_analog_channel_mode_fixed_analog_channel_level",
      "zeek.hart_ip_common_commands.enter_exit_fixed_current_mode_pv_fixed_current_level",
      "zeek.hart_ip_common_commands.find_device_response_254",
      "zeek.hart_ip_common_commands.find_device_response_configuration_change_counter",
      "zeek.hart_ip_common_commands.find_device_response_device_id",
      "zeek.hart_ip_common_commands.find_device_response_device_profile",
      "zeek.hart_ip_common_commands.find_device_response_device_revision_level",
      "zeek.hart_ip_common_commands.find_device_response_expanded_device_type",
      "zeek.hart_ip_common_commands.find_device_response_extended_field_device_status_critical_power_failure",
      "zeek.hart_ip_common_commands.find_device_response_extended_field_device_status_device_variable_alert",
      "zeek.hart_ip_common_commands.find_device_response_extended_field_device_status_failure",
      "zeek.hart_ip_common_commands.find_device_response_extended_field_device_status_function_check",
      "zeek.hart_ip_common_commands.find_device_response_extended_field_device_status_maintenance_required",
      "zeek.hart_ip_common_commands.find_device_response_extended_field_device_status_out_of_specification",
      "zeek.hart_ip_common_commands.find_device_response_extended_field_device_status_undefined_bits",
      "zeek.hart_ip_common_commands.find_device_response_flags_c8_psk_capable_field_device",
      "zeek.hart_ip_common_commands.find_device_response_flags_c8_psk_in_multi_drop_only",
      "zeek.hart_ip_common_commands.find_device_response_flags_eeprom_control",
      "zeek.hart_ip_common_commands.find_device_response_flags_ieee_802_15_4_dsss_o_qpsk_modulation",
      "zeek.hart_ip_common_commands.find_device_response_flags_mutli_sensor_field_device",
      "zeek.hart_ip_common_commands.find_device_response_flags_protocol_bridge_device",
      "zeek.hart_ip_common_commands.find_device_response_flags_safehart_capable_field_device",
      "zeek.hart_ip_common_commands.find_device_response_flags_undefined_5",
      "zeek.hart_ip_common_commands.find_device_response_hardware_revision_level_and_physical_signaling_codes_hardware_revision_level",
      "zeek.hart_ip_common_commands.find_device_response_hardware_revision_level_and_physical_signaling_codes_physical_signaling_code",
      "zeek.hart_ip_common_commands.find_device_response_hart_protocol_major_revision",
      "zeek.hart_ip_common_commands.find_device_response_last_device_variable_this",
      "zeek.hart_ip_common_commands.find_device_response_manufacturer_identification_code",
      "zeek.hart_ip_common_commands.find_device_response_minimum_preambles_master_slave",
      "zeek.hart_ip_common_commands.find_device_response_number_preambles_slave_master",
      "zeek.hart_ip_common_commands.find_device_response_private_label_distributor_code",
      "zeek.hart_ip_common_commands.find_device_response_software_revision_level",
      "zeek.hart_ip_common_commands.lock_device_lock_code",
      "zeek.hart_ip_common_commands.poll_sub_device_request_channel",
      "zeek.hart_ip_common_commands.poll_sub_device_request_io_card",
      "zeek.hart_ip_common_commands.poll_sub_device_request_sub_device_polling_address",
      "zeek.hart_ip_common_commands.poll_sub_device_response_254",
      "zeek.hart_ip_common_commands.poll_sub_device_response_configuration_change_counter",
      "zeek.hart_ip_common_commands.poll_sub_device_response_device_id",
      "zeek.hart_ip_common_commands.poll_sub_device_response_device_profile",
      "zeek.hart_ip_common_commands.poll_sub_device_response_device_revision_level",
      "zeek.hart_ip_common_commands.poll_sub_device_response_expanded_device_type",
      "zeek.hart_ip_common_commands.poll_sub_device_response_extended_field_device_status_critical_power_failure",
      "zeek.hart_ip_common_commands.poll_sub_device_response_extended_field_device_status_device_variable_alert",
      "zeek.hart_ip_common_commands.poll_sub_device_response_extended_field_device_status_failure",
      "zeek.hart_ip_common_commands.poll_sub_device_response_extended_field_device_status_function_check",
      "zeek.hart_ip_common_commands.poll_sub_device_response_extended_field_device_status_maintenance_required",
      "zeek.hart_ip_common_commands.poll_sub_device_response_extended_field_device_status_out_of_specification",
      "zeek.hart_ip_common_commands.poll_sub_device_response_extended_field_device_status_undefined_bits",
      "zeek.hart_ip_common_commands.poll_sub_device_response_flags_c8_psk_capable_field_device",
      "zeek.hart_ip_common_commands.poll_sub_device_response_flags_c8_psk_in_multi_drop_only",
      "zeek.hart_ip_common_commands.poll_sub_device_response_flags_eeprom_control",
      "zeek.hart_ip_common_commands.poll_sub_device_response_flags_ieee_802_15_4_dsss_o_qpsk_modulation",
      "zeek.hart_ip_common_commands.poll_sub_device_response_flags_mutli_sensor_field_device",
      "zeek.hart_ip_common_commands.poll_sub_device_response_flags_protocol_bridge_device",
      "zeek.hart_ip_common_commands.poll_sub_device_response_flags_safehart_capable_field_device",
      "zeek.hart_ip_common_commands.poll_sub_device_response_flags_undefined_5",
      "zeek.hart_ip_common_commands.poll_sub_device_response_hardware_revision_level_and_physical_signaling_codes_hardware_revision_level",
      "zeek.hart_ip_common_commands.poll_sub_device_response_hardware_revision_level_and_physical_signaling_codes_physical_signaling_code",
      "zeek.hart_ip_common_commands.poll_sub_device_response_hart_protocol_major_revision",
      "zeek.hart_ip_common_commands.poll_sub_device_response_last_device_variable_this",
      "zeek.hart_ip_common_commands.poll_sub_device_response_manufacturer_identification_code",
      "zeek.hart_ip_common_commands.poll_sub_device_response_minimum_preambles_master_slave",
      "zeek.hart_ip_common_commands.poll_sub_device_response_number_preambles_slave_master",
      "zeek.hart_ip_common_commands.poll_sub_device_response_private_label_distributor_code",
      "zeek.hart_ip_common_commands.poll_sub_device_response_software_revision_level",
      "zeek.hart_ip_common_commands.read_analog_channel_and_percent_of_range_request_analog_channel_number_code",
      "zeek.hart_ip_common_commands.read_analog_channel_and_percent_of_range_response_analog_channel_level",
      "zeek.hart_ip_common_commands.read_analog_channel_and_percent_of_range_response_analog_channel_number_code",
      "zeek.hart_ip_common_commands.read_analog_channel_and_percent_of_range_response_analog_channel_percent_of_range",
      "zeek.hart_ip_common_commands.read_analog_channel_and_percent_of_range_response_analog_channel_units_code",
      "zeek.hart_ip_common_commands.read_analog_channel_endpoint_values_request_analog_channel_number_code",
      "zeek.hart_ip_common_commands.read_analog_channel_endpoint_values_response_analog_channel_lower_endpoint_value",
      "zeek.hart_ip_common_commands.read_analog_channel_endpoint_values_response_analog_channel_lower_limit_value",
      "zeek.hart_ip_common_commands.read_analog_channel_endpoint_values_response_analog_channel_number_code",
      "zeek.hart_ip_common_commands.read_analog_channel_endpoint_values_response_analog_channel_upper_and_lower_endpoint_values_units_code",
      "zeek.hart_ip_common_commands.read_analog_channel_endpoint_values_response_analog_channel_upper_endpoint_value",
      "zeek.hart_ip_common_commands.read_analog_channel_endpoint_values_response_analog_channel_upper_limit_value",
      "zeek.hart_ip_common_commands.read_analog_channel_information_request_analog_channel_number_code",
      "zeek.hart_ip_common_commands.read_analog_channel_information_response_analog_channel_alarm_selection_code",
      "zeek.hart_ip_common_commands.read_analog_channel_information_response_analog_channel_damping_value",
      "zeek.hart_ip_common_commands.read_analog_channel_information_response_analog_channel_flags_is_input",
      "zeek.hart_ip_common_commands.read_analog_channel_information_response_analog_channel_flags_is_simulated",
      "zeek.hart_ip_common_commands.read_analog_channel_information_response_analog_channel_flags_undefined_bits_1_6",
      "zeek.hart_ip_common_commands.read_analog_channel_information_response_analog_channel_lower_range_value",
      "zeek.hart_ip_common_commands.read_analog_channel_information_response_analog_channel_number_code",
      "zeek.hart_ip_common_commands.read_analog_channel_information_response_analog_channel_transfer_function_code",
      "zeek.hart_ip_common_commands.read_analog_channel_information_response_analog_channel_upper_and_lower_range_values_units_code",
      "zeek.hart_ip_common_commands.read_analog_channel_information_response_analog_channel_upper_range_value",
      "zeek.hart_ip_common_commands.read_analog_channels_request_analog_channel_number_code_slot0",
      "zeek.hart_ip_common_commands.read_analog_channels_request_analog_channel_number_code_slot1",
      "zeek.hart_ip_common_commands.read_analog_channels_request_analog_channel_number_code_slot2",
      "zeek.hart_ip_common_commands.read_analog_channels_request_analog_channel_number_code_slot3",
      "zeek.hart_ip_common_commands.read_analog_channels_response_analog_channel_level_slot0",
      "zeek.hart_ip_common_commands.read_analog_channels_response_analog_channel_level_slot1",
      "zeek.hart_ip_common_commands.read_analog_channels_response_analog_channel_level_slot2",
      "zeek.hart_ip_common_commands.read_analog_channels_response_analog_channel_level_slot3",
      "zeek.hart_ip_common_commands.read_analog_channels_response_analog_channel_number_code_slot0",
      "zeek.hart_ip_common_commands.read_analog_channels_response_analog_channel_number_code_slot1",
      "zeek.hart_ip_common_commands.read_analog_channels_response_analog_channel_number_code_slot2",
      "zeek.hart_ip_common_commands.read_analog_channels_response_analog_channel_number_code_slot3",
      "zeek.hart_ip_common_commands.read_analog_channels_response_analog_channel_units_code_slot0",
      "zeek.hart_ip_common_commands.read_analog_channels_response_analog_channel_units_code_slot1",
      "zeek.hart_ip_common_commands.read_analog_channels_response_analog_channel_units_code_slot2",
      "zeek.hart_ip_common_commands.read_analog_channels_response_analog_channel_units_code_slot3",
      "zeek.hart_ip_common_commands.read_device_variable_information_request_device_variable_code",
      "zeek.hart_ip_common_commands.read_device_variable_information_response_acquisition_period",
      "zeek.hart_ip_common_commands.read_device_variable_information_response_device_variable_classification",
      "zeek.hart_ip_common_commands.read_device_variable_information_response_device_variable_code",
      "zeek.hart_ip_common_commands.read_device_variable_information_response_device_variable_damping_value",
      "zeek.hart_ip_common_commands.read_device_variable_information_response_device_variable_family",
      "zeek.hart_ip_common_commands.read_device_variable_information_response_device_variable_limits_minimum_span_units_code",
      "zeek.hart_ip_common_commands.read_device_variable_information_response_device_variable_lower_transducer_limit",
      "zeek.hart_ip_common_commands.read_device_variable_information_response_device_variable_minimum_span",
      "zeek.hart_ip_common_commands.read_device_variable_information_response_device_variable_properties_is_input",
      "zeek.hart_ip_common_commands.read_device_variable_information_response_device_variable_properties_is_simulated",
      "zeek.hart_ip_common_commands.read_device_variable_information_response_device_variable_properties_undefined_bits_1_6",
      "zeek.hart_ip_common_commands.read_device_variable_information_response_device_variable_transducer_serial_number",
      "zeek.hart_ip_common_commands.read_device_variable_information_response_device_variable_upper_transducer_limit",
      "zeek.hart_ip_common_commands.read_device_variable_trim_guidelines_device_variable_guidelines",
      "zeek.hart_ip_common_commands.read_device_variable_trim_points_device_variable_code",
      "zeek.hart_ip_common_commands.read_device_variable_trim_points_response_lower_or_single_trim_point",
      "zeek.hart_ip_common_commands.read_device_variable_trim_points_response_trim_points_units_code",
      "zeek.hart_ip_common_commands.read_device_variable_trim_points_response_upper_trim_point",
      "zeek.hart_ip_common_commands.read_device_variables_request_slot0_device_variable_code",
      "zeek.hart_ip_common_commands.read_device_variables_request_slot1_device_variable_code",
      "zeek.hart_ip_common_commands.read_device_variables_request_slot2_device_variable_code",
      "zeek.hart_ip_common_commands.read_device_variables_request_slot3_device_variable_code",
      "zeek.hart_ip_common_commands.read_device_variables_response_slot0_device_variable",
      "zeek.hart_ip_common_commands.read_device_variables_response_slot0_device_variable_code",
      "zeek.hart_ip_common_commands.read_device_variables_response_slot0_units_code",
      "zeek.hart_ip_common_commands.read_device_variables_response_slot1_device_variable",
      "zeek.hart_ip_common_commands.read_device_variables_response_slot1_device_variable_code",
      "zeek.hart_ip_common_commands.read_device_variables_response_slot1_units_code",
      "zeek.hart_ip_common_commands.read_device_variables_response_slot2_device_variable",
      "zeek.hart_ip_common_commands.read_device_variables_response_slot2_device_variable_code",
      "zeek.hart_ip_common_commands.read_device_variables_response_slot2_units_code",
      "zeek.hart_ip_common_commands.read_device_variables_response_slot3_device_variable",
      "zeek.hart_ip_common_commands.read_device_variables_response_slot3_device_variable_code",
      "zeek.hart_ip_common_commands.read_device_variables_response_slot3_units_code",
      "zeek.hart_ip_common_commands.read_dynamic_variable_assignments_response_device_variable_assigned_to_primary_variable",
      "zeek.hart_ip_common_commands.read_dynamic_variable_assignments_response_device_variable_assigned_to_quaternary_variable",
      "zeek.hart_ip_common_commands.read_dynamic_variable_assignments_response_device_variable_assigned_to_secondary_variable",
      "zeek.hart_ip_common_commands.read_dynamic_variable_assignments_response_device_variable_assigned_to_tertiary_variable",
      "zeek.hart_ip_common_commands.read_dynamic_variables_and_primary_variable_analog_channel_response_primary_variable",
      "zeek.hart_ip_common_commands.read_dynamic_variables_and_primary_variable_analog_channel_response_primary_variable_analog_channel_units_code",
      "zeek.hart_ip_common_commands.read_dynamic_variables_and_primary_variable_analog_channel_response_primary_variable_analog_level",
      "zeek.hart_ip_common_commands.read_dynamic_variables_and_primary_variable_analog_channel_response_primary_variable_units_code",
      "zeek.hart_ip_common_commands.read_dynamic_variables_and_primary_variable_analog_channel_response_quaternary_variable",
      "zeek.hart_ip_common_commands.read_dynamic_variables_and_primary_variable_analog_channel_response_quaternary_variable_units_code",
      "zeek.hart_ip_common_commands.read_dynamic_variables_and_primary_variable_analog_channel_response_secondary_variable",
      "zeek.hart_ip_common_commands.read_dynamic_variables_and_primary_variable_analog_channel_response_secondary_variable_units_code",
      "zeek.hart_ip_common_commands.read_dynamic_variables_and_primary_variable_analog_channel_response_tertiary_variable",
      "zeek.hart_ip_common_commands.read_dynamic_variables_and_primary_variable_analog_channel_response_tertiary_variable_units_code",
      "zeek.hart_ip_common_commands.read_io_channel_statistics_channel",
      "zeek.hart_ip_common_commands.read_io_channel_statistics_io_card",
      "zeek.hart_ip_common_commands.read_io_channel_statistics_response_ack_count",
      "zeek.hart_ip_common_commands.read_io_channel_statistics_response_back_count",
      "zeek.hart_ip_common_commands.read_io_channel_statistics_response_oack_count",
      "zeek.hart_ip_common_commands.read_io_channel_statistics_response_ostx_count",
      "zeek.hart_ip_common_commands.read_io_channel_statistics_response_stx_count",
      "zeek.hart_ip_common_commands.read_io_system_capabilities_response_master_mode",
      "zeek.hart_ip_common_commands.read_io_system_capabilities_response_max_channels_per_io_card",
      "zeek.hart_ip_common_commands.read_io_system_capabilities_response_max_delayed_responses_supported",
      "zeek.hart_ip_common_commands.read_io_system_capabilities_response_max_io_cards",
      "zeek.hart_ip_common_commands.read_io_system_capabilities_response_max_sub_devices_per_channel",
      "zeek.hart_ip_common_commands.read_io_system_capabilities_response_number_of_devices_detected",
      "zeek.hart_ip_common_commands.read_io_system_capabilities_response_retry_count",
      "zeek.hart_ip_common_commands.read_lock_device_state_response_lock_status_configuration_locked",
      "zeek.hart_ip_common_commands.read_lock_device_state_response_lock_status_device_locked",
      "zeek.hart_ip_common_commands.read_lock_device_state_response_lock_status_lock_gateway",
      "zeek.hart_ip_common_commands.read_lock_device_state_response_lock_status_lock_permanent",
      "zeek.hart_ip_common_commands.read_lock_device_state_response_lock_status_lock_primary",
      "zeek.hart_ip_common_commands.read_lock_device_state_response_lock_status_undefined_bits",
      "zeek.hart_ip_common_commands.read_sub_device_identity_summary_response_channel",
      "zeek.hart_ip_common_commands.read_sub_device_identity_summary_response_device_id",
      "zeek.hart_ip_common_commands.read_sub_device_identity_summary_response_device_profile",
      "zeek.hart_ip_common_commands.read_sub_device_identity_summary_response_device_revision",
      "zeek.hart_ip_common_commands.read_sub_device_identity_summary_response_expanded_device_type",
      "zeek.hart_ip_common_commands.read_sub_device_identity_summary_response_io_card",
      "zeek.hart_ip_common_commands.read_sub_device_identity_summary_response_long_tag",
      "zeek.hart_ip_common_commands.read_sub_device_identity_summary_response_manufacturer_identification_code",
      "zeek.hart_ip_common_commands.read_sub_device_identity_summary_response_private_label_distributor_code",
      "zeek.hart_ip_common_commands.read_sub_device_identity_summary_response_universal_command_revision_level",
      "zeek.hart_ip_common_commands.read_sub_device_identity_summary_sub_device_index",
      "zeek.hart_ip_common_commands.read_sub_device_statistics_response_ack_count",
      "zeek.hart_ip_common_commands.read_sub_device_statistics_response_back_count",
      "zeek.hart_ip_common_commands.read_sub_device_statistics_response_stx_count",
      "zeek.hart_ip_common_commands.read_sub_device_statistics_sub_device_index",
      "zeek.hart_ip_common_commands.read_unit_tag_descriptor_date_response_unit_date",
      "zeek.hart_ip_common_commands.read_unit_tag_descriptor_date_response_unit_descriptor",
      "zeek.hart_ip_common_commands.read_unit_tag_descriptor_date_response_unit_tag",
      "zeek.hart_ip_common_commands.reset_device_variable_trim_device_variable_trim_to_reset",
      "zeek.hart_ip_common_commands.set_device_variable_zero_device_variable_zeroed",
      "zeek.hart_ip_common_commands.set_real_time_clock_date",
      "zeek.hart_ip_common_commands.set_real_time_clock_null_bytes",
      "zeek.hart_ip_common_commands.set_real_time_clock_time_of_day",
      "zeek.hart_ip_common_commands.set_real_time_clock_time_set_code",
      "zeek.hart_ip_common_commands.squawk_squawk_control",
      "zeek.hart_ip_common_commands.trim_analog_channel_gain_analog_channel_level",
      "zeek.hart_ip_common_commands.trim_analog_channel_gain_analog_channel_number_code",
      "zeek.hart_ip_common_commands.trim_analog_channel_gain_analog_channel_units_code",
      "zeek.hart_ip_common_commands.trim_analog_channel_zero_analog_channel_level",
      "zeek.hart_ip_common_commands.trim_analog_channel_zero_analog_channel_number_code",
      "zeek.hart_ip_common_commands.trim_analog_channel_zero_analog_channel_units_code",
      "zeek.hart_ip_common_commands.trim_loop_current_gain_measured_pv_loop_current_level",
      "zeek.hart_ip_common_commands.trim_loop_current_zero_measured_pv_loop_current_level",
      "zeek.hart_ip_common_commands.write_analog_channel_additional_damping_value_analog_channel_damping_value",
      "zeek.hart_ip_common_commands.write_analog_channel_additional_damping_value_analog_channel_number_code",
      "zeek.hart_ip_common_commands.write_analog_channel_range_values_analog_channel_lower_range_value",
      "zeek.hart_ip_common_commands.write_analog_channel_range_values_analog_channel_number_code",
      "zeek.hart_ip_common_commands.write_analog_channel_range_values_analog_channel_upper_and_lower_range_values_units_code",
      "zeek.hart_ip_common_commands.write_analog_channel_range_values_analog_channel_upper_range_value",
      "zeek.hart_ip_common_commands.write_analog_channel_transfer_function_analog_channel_number_code",
      "zeek.hart_ip_common_commands.write_analog_channel_transfer_function_analog_channel_units_code",
      "zeek.hart_ip_common_commands.write_device_variable_damping_value_device_variable_code",
      "zeek.hart_ip_common_commands.write_device_variable_damping_value_device_variable_damping_value",
      "zeek.hart_ip_common_commands.write_device_variable_device_variable_code",
      "zeek.hart_ip_common_commands.write_device_variable_device_variable_status_device_family_specific_status",
      "zeek.hart_ip_common_commands.write_device_variable_device_variable_status_limit_status",
      "zeek.hart_ip_common_commands.write_device_variable_device_variable_status_more_device_variable_status_available",
      "zeek.hart_ip_common_commands.write_device_variable_device_variable_status_process_data_status",
      "zeek.hart_ip_common_commands.write_device_variable_device_variable_value",
      "zeek.hart_ip_common_commands.write_device_variable_transducer_serial_no_device_variable_code",
      "zeek.hart_ip_common_commands.write_device_variable_transducer_serial_no_device_variable_transducer_serial_number",
      "zeek.hart_ip_common_commands.write_device_variable_trim_point_device_variable_to_trim",
      "zeek.hart_ip_common_commands.write_device_variable_trim_point_trim_point",
      "zeek.hart_ip_common_commands.write_device_variable_trim_point_trim_point_value",
      "zeek.hart_ip_common_commands.write_device_variable_trim_point_trim_points_units_code",
      "zeek.hart_ip_common_commands.write_device_variable_units_code",
      "zeek.hart_ip_common_commands.write_device_variable_units_device_variable_code",
      "zeek.hart_ip_common_commands.write_device_variable_units_device_variable_units_code",
      "zeek.hart_ip_common_commands.write_device_variable_write_device_variable_command_code",
      "zeek.hart_ip_common_commands.write_dynamic_variable_assignments_device_variable_assigned_to_primary_variable",
      "zeek.hart_ip_common_commands.write_dynamic_variable_assignments_device_variable_assigned_to_quaternary_variable",
      "zeek.hart_ip_common_commands.write_dynamic_variable_assignments_device_variable_assigned_to_secondary_variable",
      "zeek.hart_ip_common_commands.write_dynamic_variable_assignments_device_variable_assigned_to_tertiary_variable",
      "zeek.hart_ip_common_commands.write_io_system_master_mode_master_mode",
      "zeek.hart_ip_common_commands.write_io_system_retry_count_retry_count",
      "zeek.hart_ip_common_commands.write_number_of_response_preambles_number_of_preambles",
      "zeek.hart_ip_common_commands.write_primary_variable_damping_value_pv_damping_value",
      "zeek.hart_ip_common_commands.write_primary_variable_range_values_p_v_lower_range_value",
      "zeek.hart_ip_common_commands.write_primary_variable_range_values_pv_upper_and_lower_range_values_units_code",
      "zeek.hart_ip_common_commands.write_primary_variable_range_values_pv_upper_range_value",
      "zeek.hart_ip_common_commands.write_primary_variable_transducer_serial_number_pv_transducer_serial_number",
      "zeek.hart_ip_common_commands.write_primary_variable_transfer_function_p_v_transfer_function_code",
      "zeek.hart_ip_common_commands.write_primary_variable_units_pv_unit_codes",
      "zeek.hart_ip_common_commands.write_unit_tag_descriptor_date_unit_date",
      "zeek.hart_ip_common_commands.write_unit_tag_descriptor_date_unit_descriptor",
      "zeek.hart_ip_common_commands.write_unit_tag_descriptor_date_unit_tag",
      "zeek.hart_ip_direct_pdu_command.direct_pdu_command_byte_count",
      "zeek.hart_ip_direct_pdu_command.direct_pdu_command_command_number",
      "zeek.hart_ip_direct_pdu_command.direct_pdu_command_data_data",
      "zeek.hart_ip_direct_pdu_command.direct_pdu_contents_response_response_code",
      "zeek.hart_ip.command_number_link_id",
      "zeek.hart_ip.direct_pdu_command_link_id",
      "zeek.hart_ip.direct_pdu_device_status_cold_start",
      "zeek.hart_ip.direct_pdu_device_status_configuration_changed",
      "zeek.hart_ip.direct_pdu_device_status_device_malfunction",
      "zeek.hart_ip.direct_pdu_device_status_loop_current_fixed",
      "zeek.hart_ip.direct_pdu_device_status_loop_current_saturated",
      "zeek.hart_ip.direct_pdu_device_status_more_status_available",
      "zeek.hart_ip.direct_pdu_device_status_non_primary_variable_out_of_limits",
      "zeek.hart_ip.direct_pdu_device_status_primary_variable_out_of_limits",
      "zeek.hart_ip.direct_pdu_extended_status_critical_power_failure",
      "zeek.hart_ip.direct_pdu_extended_status_device_variable_alert",
      "zeek.hart_ip.direct_pdu_extended_status_failure",
      "zeek.hart_ip.direct_pdu_extended_status_function_check",
      "zeek.hart_ip.direct_pdu_extended_status_maintenance_required",
      "zeek.hart_ip.direct_pdu_extended_status_out_of_specification",
      "zeek.hart_ip.direct_pdu_extended_status_undefined_bits",
      "zeek.hart_ip.header_length",
      "zeek.hart_ip.header_message_id",
      "zeek.hart_ip.header_message_type_message_type",
      "zeek.hart_ip.header_message_type_reserved",
      "zeek.hart_ip.header_sequence_number",
      "zeek.hart_ip.header_status_code",
      "zeek.hart_ip.header_version",
      "zeek.hart_ip.message_packet_bytes",
      "zeek.hart_ip.read_audit_log_last_security_change",
      "zeek.hart_ip.read_audit_log_number_of_records",
      "zeek.hart_ip.read_audit_log_power_up_time",
      "zeek.hart_ip.read_audit_log_server_status_insecure_syslog_connection",
      "zeek.hart_ip.read_audit_log_server_status_syslog_server_located_but_connection_failed",
      "zeek.hart_ip.read_audit_log_server_status_unable_to_locate_syslog_server",
      "zeek.hart_ip.read_audit_log_server_status_undefined_bits",
      "zeek.hart_ip.read_audit_log_session_record_size",
      "zeek.hart_ip.read_audit_log_start_record",
      "zeek.hart_ip.session_initiate_inactivity_close_timer",
      "zeek.hart_ip.session_initiate_master_type",
      "zeek.hart_ip.session_log_record_link_id",
      "zeek.hart_ip.token_passing_pdu_address_v4",
      "zeek.hart_ip.token_passing_pdu_address_v6",
      "zeek.hart_ip.token_passing_pdu_byte_count",
      "zeek.hart_ip.token_passing_pdu_check_byte",
      "zeek.hart_ip.token_passing_pdu_command_number",
      "zeek.hart_ip.token_passing_pdu_contents_data_data",
      "zeek.hart_ip.token_passing_pdu_contents_response_device_status_cold_start",
      "zeek.hart_ip.token_passing_pdu_contents_response_device_status_configuration_changed",
      "zeek.hart_ip.token_passing_pdu_contents_response_device_status_device_malfunction",
      "zeek.hart_ip.token_passing_pdu_contents_response_device_status_loop_current_fixed",
      "zeek.hart_ip.token_passing_pdu_contents_response_device_status_loop_current_saturated",
      "zeek.hart_ip.token_passing_pdu_contents_response_device_status_more_status_available",
      "zeek.hart_ip.token_passing_pdu_contents_response_device_status_non_primary_variable_out_of_limits",
      "zeek.hart_ip.token_passing_pdu_contents_response_device_status_primary_variable_out_of_limits",
      "zeek.hart_ip.token_passing_pdu_contents_response_response_code",
      "zeek.hart_ip.token_passing_pdu_delimiter_address_type",
      "zeek.hart_ip.token_passing_pdu_delimiter_expansion_bytes",
      "zeek.hart_ip.token_passing_pdu_delimiter_frame_type",
      "zeek.hart_ip.token_passing_pdu_delimiter_physical_layer_type",
      "zeek.hart_ip_session_record.session_log_record_client_i_pv4_address",
      "zeek.hart_ip_session_record.session_log_record_client_i_pv6_address",
      "zeek.hart_ip_session_record.session_log_record_client_port",
      "zeek.hart_ip_session_record.session_log_record_connect_time",
      "zeek.hart_ip_session_record.session_log_record_disconnect_time",
      "zeek.hart_ip_session_record.session_log_record_end_configuration_change_count",
      "zeek.hart_ip_session_record.session_log_record_num_publish_pdu",
      "zeek.hart_ip_session_record.session_log_record_num_request_pdu",
      "zeek.hart_ip_session_record.session_log_record_num_response_pdu",
      "zeek.hart_ip_session_record.session_log_record_server_port",
      "zeek.hart_ip_session_record.session_log_record_session_status_summary_aborted_session",
      "zeek.hart_ip_session_record.session_log_record_session_status_summary_bad_session_initialization",
      "zeek.hart_ip_session_record.session_log_record_session_status_summary_insecure_session",
      "zeek.hart_ip_session_record.session_log_record_session_status_summary_session_timeout",
      "zeek.hart_ip_session_record.session_log_record_session_status_summary_undefined_bits",
      "zeek.hart_ip_session_record.session_log_record_session_status_summary_writes_occured",
      "zeek.hart_ip_session_record.session_log_record_start_configuration_change_count",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_analog_channel_analog_channel",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_analog_channel_saturated_quaternary_analog",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_analog_channel_saturated_quinary_analog",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_analog_channel_saturated_secondary_analog",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_analog_channel_saturated_tertiary_analog",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_analog_channel_saturated_undefined_bits",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_analog_channel_undefined_bits",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_device_operating_mode",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_device_specific_status_0",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_device_specific_status_1",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_extended_field_device_status_critical_power_failure",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_extended_field_device_status_device_variable_alert",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_extended_field_device_status_failure",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_extended_field_device_status_function_check",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_extended_field_device_status_maintenance_required",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_extended_field_device_status_out_of_specification",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_extended_field_device_status_undefined_bits",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_standardized_status0_device_configuration_lock",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_standardized_status0_device_variable_simulation_active",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_standardized_status0_electronic_defect",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_standardized_status0_environmental_conditions_out_of_range",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_standardized_status0_non_volatile_memory_defect",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_standardized_status0_power_supply_conditions_out_of_range",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_standardized_status0_volatile_memory_defect",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_standardized_status0_watchdog_reset_executed",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_standardized_status1_battery_or_power_supply_needs_maintenance",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_standardized_status1_discrete_variable_simulation_active",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_standardized_status1_event_notification_overflow",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_standardized_status1_reserved",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_standardized_status1_status_simulation_active",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_standardized_status1_undefined_bits",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_standardized_status2_duplicate_master_detected",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_standardized_status2_stale_data_notice",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_standardized_status2_sub_device_list_changed",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_standardized_status2_sub_device_mismatch",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_standardized_status2_sub_device_with_duplicate_id",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_standardized_status2_undefined_bits",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_standardized_status3_bandwith_allocation_pending",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_standardized_status3_block_transfer_pending",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_standardized_status3_capacity_denied",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_standardized_status3_radio_failure",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_standardized_status3_resereved",
      "zeek.hart_ip_universal_commands.read_additional_device_status_contents_standardized_status3_undefined_bits",
      "zeek.hart_ip_universal_commands.read_device_information_response_250",
      "zeek.hart_ip_universal_commands.read_device_information_response_p_v_alarm_selection_code",
      "zeek.hart_ip_universal_commands.read_device_information_response_p_v_analog_channel_flags_analog_channel",
      "zeek.hart_ip_universal_commands.read_device_information_response_p_v_analog_channel_flags_undefined_bits",
      "zeek.hart_ip_universal_commands.read_device_information_response_p_v_damping_value",
      "zeek.hart_ip_universal_commands.read_device_information_response_p_v_lower_range_value",
      "zeek.hart_ip_universal_commands.read_device_information_response_p_v_transfer_function_code",
      "zeek.hart_ip_universal_commands.read_device_information_response_p_v_upper_lower_range",
      "zeek.hart_ip_universal_commands.read_device_information_response_p_v_upper_range_value",
      "zeek.hart_ip_universal_commands.read_device_information_response_write_protect_code",
      "zeek.hart_ip_universal_commands.read_device_variable_request_slot0_device_variable_code",
      "zeek.hart_ip_universal_commands.read_device_variable_request_slot1_device_variable_code",
      "zeek.hart_ip_universal_commands.read_device_variable_request_slot2_device_variable_code",
      "zeek.hart_ip_universal_commands.read_device_variable_request_slot3_device_variable_code",
      "zeek.hart_ip_universal_commands.read_device_variable_request_slot4_device_variable_code",
      "zeek.hart_ip_universal_commands.read_device_variable_request_slot5_device_variable_code",
      "zeek.hart_ip_universal_commands.read_device_variable_request_slot6_device_variable_code",
      "zeek.hart_ip_universal_commands.read_device_variable_request_slot7_device_variable_code",
      "zeek.hart_ip_universal_commands.read_device_variable_response_extended_field_device_status_critical_power_failure",
      "zeek.hart_ip_universal_commands.read_device_variable_response_extended_field_device_status_device_variable_alert",
      "zeek.hart_ip_universal_commands.read_device_variable_response_extended_field_device_status_failure",
      "zeek.hart_ip_universal_commands.read_device_variable_response_extended_field_device_status_function_check",
      "zeek.hart_ip_universal_commands.read_device_variable_response_extended_field_device_status_maintenance_required",
      "zeek.hart_ip_universal_commands.read_device_variable_response_extended_field_device_status_out_of_specification",
      "zeek.hart_ip_universal_commands.read_device_variable_response_extended_field_device_status_undefined_bits",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot0_device_variable",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot0_device_variable_class",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot0_device_variable_code",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot0_device_variable_status_device_family_specific_status",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot0_device_variable_status_limit_status",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot0_device_variable_status_more_device_variable_status_available",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot0_device_variable_status_process_data_status",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot0_time",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot0_units_code",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot1_device_variable",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot1_device_variable_class",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot1_device_variable_code",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot1_device_variable_status_device_family_specific_status",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot1_device_variable_status_limit_status",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot1_device_variable_status_more_device_variable_status_available",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot1_device_variable_status_process_data_status",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot1_units_code",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot2_device_variable",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot2_device_variable_class",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot2_device_variable_code",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot2_device_variable_status_device_family_specific_status",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot2_device_variable_status_limit_status",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot2_device_variable_status_more_device_variable_status_available",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot2_device_variable_status_process_data_status",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot2_units_code",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot3_device_variable",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot3_device_variable_class",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot3_device_variable_code",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot3_device_variable_status_device_family_specific_status",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot3_device_variable_status_limit_status",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot3_device_variable_status_more_device_variable_status_available",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot3_device_variable_status_process_data_status",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot3_units_code",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot4_device_variable",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot4_device_variable_class",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot4_device_variable_code",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot4_device_variable_status_device_family_specific_status",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot4_device_variable_status_limit_status",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot4_device_variable_status_more_device_variable_status_available",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot4_device_variable_status_process_data_status",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot4_units_code",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot5_device_variable",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot5_device_variable_class",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot5_device_variable_code",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot5_device_variable_status_device_family_specific_status",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot5_device_variable_status_limit_status",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot5_device_variable_status_more_device_variable_status_available",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot5_device_variable_status_process_data_status",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot5_units_code",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot6_device_variable",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot6_device_variable_class",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot6_device_variable_code",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot6_device_variable_status_device_family_specific_status",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot6_device_variable_status_limit_status",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot6_device_variable_status_more_device_variable_status_available",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot6_device_variable_status_process_data_status",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot6_units_code",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot7_device_variable",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot7_device_variable_class",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot7_device_variable_code",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot7_device_variable_status_device_family_specific_status",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot7_device_variable_status_limit_status",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot7_device_variable_status_more_device_variable_status_available",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot7_device_variable_status_process_data_status",
      "zeek.hart_ip_universal_commands.read_device_variable_response_slot7_units_code",
      "zeek.hart_ip_universal_commands.read_dynamic_variable_classifications_response_primary_variable_classification",
      "zeek.hart_ip_universal_commands.read_dynamic_variable_classifications_response_quaternary_variable_classification",
      "zeek.hart_ip_universal_commands.read_dynamic_variable_classifications_response_secondary_variable_classification",
      "zeek.hart_ip_universal_commands.read_dynamic_variable_classifications_response_tertiary_variable_classification",
      "zeek.hart_ip_universal_commands.read_dynamic_variable_response_primary_variable",
      "zeek.hart_ip_universal_commands.read_dynamic_variable_response_primary_variable_loop_current",
      "zeek.hart_ip_universal_commands.read_dynamic_variable_response_primary_variable_units",
      "zeek.hart_ip_universal_commands.read_dynamic_variable_response_quaternary_variable",
      "zeek.hart_ip_universal_commands.read_dynamic_variable_response_quaternary_variable_units",
      "zeek.hart_ip_universal_commands.read_dynamic_variable_response_secondary_variable",
      "zeek.hart_ip_universal_commands.read_dynamic_variable_response_secondary_variable_units",
      "zeek.hart_ip_universal_commands.read_dynamic_variable_response_tertiary_variable",
      "zeek.hart_ip_universal_commands.read_dynamic_variable_response_tertiary_variable_units",
      "zeek.hart_ip_universal_commands.read_final_assembly_number_response_final_assembly_number",
      "zeek.hart_ip_universal_commands.read_long_tag_response_long_tag",
      "zeek.hart_ip_universal_commands.read_loop_configuration_response_loop_current_mode",
      "zeek.hart_ip_universal_commands.read_loop_configuration_response_polling_address_device",
      "zeek.hart_ip_universal_commands.read_loop_current_response_primary_variable_loop_current",
      "zeek.hart_ip_universal_commands.read_loop_current_response_primary_variable_percent_range",
      "zeek.hart_ip_universal_commands.read_message_response_message",
      "zeek.hart_ip_universal_commands.read_primary_variable_response_primary_variable",
      "zeek.hart_ip_universal_commands.read_primary_variable_response_primary_variable_units",
      "zeek.hart_ip_universal_commands.read_primary_variable_transducer_information_response_p_v_lower_transducer_limit",
      "zeek.hart_ip_universal_commands.read_primary_variable_transducer_information_response_p_v_minimum_span",
      "zeek.hart_ip_universal_commands.read_primary_variable_transducer_information_response_p_v_transducer_limits_units",
      "zeek.hart_ip_universal_commands.read_primary_variable_transducer_information_response_p_v_transducer_serial_number",
      "zeek.hart_ip_universal_commands.read_primary_variable_transducer_information_response_p_v_upper_transducer_limit",
      "zeek.hart_ip_universal_commands.read_tag_response_date_code",
      "zeek.hart_ip_universal_commands.read_tag_response_descriptor",
      "zeek.hart_ip_universal_commands.read_tag_response_tag",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_request_long_tag",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_response_254",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_response_configuration_change_counter",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_response_device_id",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_response_device_profile",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_response_device_revision_level",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_response_expanded_device_type",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_response_extended_field_device_status_critical_power_failure",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_response_extended_field_device_status_device_variable_alert",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_response_extended_field_device_status_failure",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_response_extended_field_device_status_function_check",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_response_extended_field_device_status_maintenance_required",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_response_extended_field_device_status_out_of_specification",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_response_extended_field_device_status_undefined_bits",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_response_flags_c8_psk_capable_field_device",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_response_flags_c8_psk_in_multi_drop_only",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_response_flags_eeprom_control",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_response_flags_ieee_802_15_4_dsss_o_qpsk_modulation",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_response_flags_mutli_sensor_field_device",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_response_flags_protocol_bridge_device",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_response_flags_safehart_capable_field_device",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_response_flags_undefined_5",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_response_hardware_revision_level_and_physical_signaling_codes_hardware_revision_level",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_response_hardware_revision_level_and_physical_signaling_codes_physical_signaling_code",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_response_hart_protocol_major_revision",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_response_last_device_variable_this",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_response_manufacturer_identification_code",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_response_minimum_preambles_master_slave",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_response_number_preambles_slave_master",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_response_private_label_distributor_code",
      "zeek.hart_ip_universal_commands.read_unique_identifier_long_tag_response_software_revision_level",
      "zeek.hart_ip_universal_commands.read_unique_identifier_response_254",
      "zeek.hart_ip_universal_commands.read_unique_identifier_response_configuration_change_counter",
      "zeek.hart_ip_universal_commands.read_unique_identifier_response_device_id",
      "zeek.hart_ip_universal_commands.read_unique_identifier_response_device_profile",
      "zeek.hart_ip_universal_commands.read_unique_identifier_response_device_revision_level",
      "zeek.hart_ip_universal_commands.read_unique_identifier_response_expanded_device_type",
      "zeek.hart_ip_universal_commands.read_unique_identifier_response_extended_field_device_status_critical_power_failure",
      "zeek.hart_ip_universal_commands.read_unique_identifier_response_extended_field_device_status_device_variable_alert",
      "zeek.hart_ip_universal_commands.read_unique_identifier_response_extended_field_device_status_failure",
      "zeek.hart_ip_universal_commands.read_unique_identifier_response_extended_field_device_status_function_check",
      "zeek.hart_ip_universal_commands.read_unique_identifier_response_extended_field_device_status_maintenance_required",
      "zeek.hart_ip_universal_commands.read_unique_identifier_response_extended_field_device_status_out_of_specification",
      "zeek.hart_ip_universal_commands.read_unique_identifier_response_extended_field_device_status_undefined_bits",
      "zeek.hart_ip_universal_commands.read_unique_identifier_response_flags_c8_psk_capable_field_device",
      "zeek.hart_ip_universal_commands.read_unique_identifier_response_flags_c8_psk_in_multi_drop_only",
      "zeek.hart_ip_universal_commands.read_unique_identifier_response_flags_eeprom_control",
      "zeek.hart_ip_universal_commands.read_unique_identifier_response_flags_ieee_802_15_4_dsss_o_qpsk_modulation",
      "zeek.hart_ip_universal_commands.read_unique_identifier_response_flags_mutli_sensor_field_device",
      "zeek.hart_ip_universal_commands.read_unique_identifier_response_flags_protocol_bridge_device",
      "zeek.hart_ip_universal_commands.read_unique_identifier_response_flags_safehart_capable_field_device",
      "zeek.hart_ip_universal_commands.read_unique_identifier_response_flags_undefined_5",
      "zeek.hart_ip_universal_commands.read_unique_identifier_response_hardware_revision_level_and_physical_signaling_codes_hardware_revision_level",
      "zeek.hart_ip_universal_commands.read_unique_identifier_response_hardware_revision_level_and_physical_signaling_codes_physical_signaling_code",
      "zeek.hart_ip_universal_commands.read_unique_identifier_response_hart_protocol_major_revision",
      "zeek.hart_ip_universal_commands.read_unique_identifier_response_last_device_variable_this",
      "zeek.hart_ip_universal_commands.read_unique_identifier_response_manufacturer_identification_code",
      "zeek.hart_ip_universal_commands.read_unique_identifier_response_minimum_preambles_master_slave",
      "zeek.hart_ip_universal_commands.read_unique_identifier_response_number_preambles_slave_master",
      "zeek.hart_ip_universal_commands.read_unique_identifier_response_private_label_distributor_code",
      "zeek.hart_ip_universal_commands.read_unique_identifier_response_software_revision_level",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_request_tag",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_response_254",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_response_configuration_change_counter",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_response_device_id",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_response_device_profile",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_response_device_revision_level",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_response_expanded_device_type",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_response_extended_field_device_status_critical_power_failure",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_response_extended_field_device_status_device_variable_alert",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_response_extended_field_device_status_failure",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_response_extended_field_device_status_function_check",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_response_extended_field_device_status_maintenance_required",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_response_extended_field_device_status_out_of_specification",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_response_extended_field_device_status_undefined_bits",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_response_flags_c8_psk_capable_field_device",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_response_flags_c8_psk_in_multi_drop_only",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_response_flags_eeprom_control",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_response_flags_ieee_802_15_4_dsss_o_qpsk_modulation",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_response_flags_mutli_sensor_field_device",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_response_flags_protocol_bridge_device",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_response_flags_safehart_capable_field_device",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_response_flags_undefined_5",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_response_hardware_revision_level_and_physical_signaling_codes_hardware_revision_level",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_response_hardware_revision_level_and_physical_signaling_codes_physical_signaling_code",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_response_hart_protocol_major_revision",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_response_last_device_variable_this",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_response_manufacturer_identification_code",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_response_minimum_preambles_master_slave",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_response_number_preambles_slave_master",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_response_private_label_distributor_code",
      "zeek.hart_ip_universal_commands.read_unique_identifier_tag_response_software_revision_level",
      "zeek.hart_ip_universal_commands.reset_configuration_changed_flag_configuration_change_counter",
      "zeek.hart_ip_universal_commands.write_final_assembly_number_final_assembly_number",
      "zeek.hart_ip_universal_commands.write_long_tag_long_tag",
      "zeek.hart_ip_universal_commands.write_message_message_string",
      "zeek.hart_ip_universal_commands.write_polling_address_loop_current_mode",
      "zeek.hart_ip_universal_commands.write_polling_address_polling_address_device",
      "zeek.hart_ip_universal_commands.write_tag_descriptor_date_date_code",
      "zeek.hart_ip_universal_commands.write_tag_descriptor_date_record_keeping_descriptor",
      "zeek.hart_ip_universal_commands.write_tag_descriptor_date_tag",
      "zeek.http.client_header_names",
      "zeek.http.host",
      "zeek.http.info_code",
      "zeek.http.info_msg",
      "zeek.http.ja4h",
      "zeek.http.method",
      "zeek.http.orig_filenames",
      "zeek.http.orig_fuids",
      "zeek.http.orig_mime_types",
      "zeek.http.origin",
      "zeek.http.post_password_plain",
      "zeek.http.post_username",
      "zeek.http.proxied",
      "zeek.http.referrer",
      "zeek.http.request_body_len",
      "zeek.http.resp_filenames",
      "zeek.http.resp_fuids",
      "zeek.http.resp_mime_types",
      "zeek.http.response_body_len",
      "zeek.http.server_header_names",
      "zeek.http.status_code",
      "zeek.http.status_msg",
      "zeek.http.tags",
      "zeek.http.trans_depth",
      "zeek.http.uri",
      "zeek.http.user_agent",
      "zeek.http.version",
      "zeek.intel.cif_confidence",
      "zeek.intel.file_description",
      "zeek.intel.file_mime_type",
      "zeek.intel.seen_node",
      "zeek.intel.seen_where",
      "zeek.ipsec.certificates",
      "zeek.ipsec.doi",
      "zeek.ipsec.exchange_type",
      "zeek.ipsec.flag_a",
      "zeek.ipsec.flag_c",
      "zeek.ipsec.flag_e",
      "zeek.ipsec.flag_i",
      "zeek.ipsec.flag_r",
      "zeek.ipsec.flag_v",
      "zeek.ipsec.flags",
      "zeek.ipsec.hash",
      "zeek.ipsec.initiator_spi",
      "zeek.ipsec.ke_dh_groups",
      "zeek.ipsec.length",
      "zeek.ipsec.maj_ver",
      "zeek.ipsec.message_id",
      "zeek.ipsec.min_ver",
      "zeek.ipsec.notify_messages",
      "zeek.ipsec.proposals",
      "zeek.ipsec.protocol_id",
      "zeek.ipsec.responder_spi",
      "zeek.ipsec.situation",
      "zeek.ipsec.transform_attributes",
      "zeek.ipsec.transforms",
      "zeek.ipsec.vendor_ids",
      "zeek.irc.addl",
      "zeek.irc.command",
      "zeek.irc.dcc_file_name",
      "zeek.irc.dcc_file_size",
      "zeek.irc.dcc_mime_type",
      "zeek.irc.nick",
      "zeek.irc.value",
      "zeek.kerberos.cipher",
      "zeek.kerberos.client_cert_fuid",
      "zeek.kerberos.client_cert_subject",
      "zeek.kerberos.cname",
      "zeek.kerberos.error_msg",
      "zeek.kerberos.forwardable",
      "zeek.kerberos.from",
      "zeek.kerberos.renewable",
      "zeek.kerberos.request_type",
      "zeek.kerberos.server_cert_fuid",
      "zeek.kerberos.server_cert_subject",
      "zeek.kerberos.sname",
      "zeek.kerberos.success",
      "zeek.kerberos.till",
      "zeek.known_certs.issuer_subject",
      "zeek.known_certs.serial",
      "zeek.known_certs.subject",
      "zeek.known_modbus.device_type",
      "zeek.known_routers.ttl",
      "zeek.known_routers.hlim",
      "zeek.ldap.argument",
      "zeek.ldap.message_id",
      "zeek.ldap.object",
      "zeek.ldap.operation",
      "zeek.ldap.result_code",
      "zeek.ldap.result_message",
      "zeek.ldap.version",
      "zeek.ldap_search.attributes",
      "zeek.ldap_search.base_object",
      "zeek.ldap_search.deref",
      "zeek.ldap_search.filter",
      "zeek.ldap_search.message_id",
      "zeek.ldap_search.result_code",
      "zeek.ldap_search.result_count",
      "zeek.ldap_search.result_message",
      "zeek.ldap_search.scope",
      "zeek.login.client_user",
      "zeek.login.confused",
      "zeek.login.success",
      "zeek.modbus.exception",
      "zeek.modbus.func",
      "zeek.modbus.mei_type",
      "zeek.modbus.network_direction",
      "zeek.modbus.trans_id",
      "zeek.modbus.unit_id",
      "zeek.modbus_detailed.address",
      "zeek.modbus_detailed.quantity",
      "zeek.modbus_detailed.values",
      "zeek.modbus_mask_write_register.and_mask",
      "zeek.modbus_mask_write_register.or_mask",
      "zeek.modbus_read_device_identification.conformity_level",
      "zeek.modbus_read_device_identification.conformity_level_code",
      "zeek.modbus_read_device_identification.device_id_code",
      "zeek.modbus_read_device_identification.object_id",
      "zeek.modbus_read_device_identification.object_id_code",
      "zeek.modbus_read_device_identification.object_value",
      "zeek.modbus_read_write_multiple_registers.read_quantity",
      "zeek.modbus_read_write_multiple_registers.read_registers",
      "zeek.modbus_read_write_multiple_registers.read_start_address",
      "zeek.modbus_read_write_multiple_registers.write_registers",
      "zeek.modbus_read_write_multiple_registers.write_start_address",
      "zeek.mqtt_connect.client_id",
      "zeek.mqtt_connect.connect_status",
      "zeek.mqtt_connect.proto_name",
      "zeek.mqtt_connect.proto_version",
      "zeek.mqtt_connect.will_payload",
      "zeek.mqtt_connect.will_topic",
      "zeek.mqtt_publish.from_client",
      "zeek.mqtt_publish.payload",
      "zeek.mqtt_publish.payload_dict.messageType",
      "zeek.mqtt_publish.payload_len",
      "zeek.mqtt_publish.qos",
      "zeek.mqtt_publish.retain",
      "zeek.mqtt_publish.status",
      "zeek.mqtt_publish.topic",
      "zeek.mqtt_subscribe.ack",
      "zeek.mqtt_subscribe.action",
      "zeek.mqtt_subscribe.granted_qos_level",
      "zeek.mqtt_subscribe.qos_levels",
      "zeek.mqtt_subscribe.topics",
      "zeek.mysql.arg",
      "zeek.mysql.cmd",
      "zeek.mysql.response",
      "zeek.mysql.rows",
      "zeek.mysql.success",
      "zeek.notice.actions",
      "zeek.notice.dropped",
      "zeek.notice.dst",
      "zeek.notice.file_desc",
      "zeek.notice.file_mime_type",
      "zeek.notice.msg",
      "zeek.notice.n",
      "zeek.notice.note",
      "zeek.notice.p",
      "zeek.notice.peer_descr",
      "zeek.notice.remote_location_city",
      "zeek.notice.remote_location_country_code",
      "zeek.notice.remote_location_latitude",
      "zeek.notice.remote_location_longitude",
      "zeek.notice.remote_location_region",
      "zeek.notice.src",
      "zeek.notice.sub",
      "zeek.notice.suppress_for",
      "zeek.ntlm.domain",
      "zeek.ntlm.host",
      "zeek.ntlm.server_dns_computer",
      "zeek.ntlm.server_nb_computer",
      "zeek.ntlm.server_tree",
      "zeek.ntlm.status",
      "zeek.ntlm.success",
      "zeek.ntp.mode",
      "zeek.ntp.mode_str",
      "zeek.ntp.num_exts",
      "zeek.ntp.org_time",
      "zeek.ntp.poll",
      "zeek.ntp.precision",
      "zeek.ntp.rec_time",
      "zeek.ntp.ref_id",
      "zeek.ntp.ref_time",
      "zeek.ntp.root_delay",
      "zeek.ntp.root_disp",
      "zeek.ntp.stratum",
      "zeek.ntp.version",
      "zeek.ntp.xmt_time",
      "zeek.ocsp.certStatus",
      "zeek.ocsp.hashAlgorithm",
      "zeek.ocsp.issuerKeyHash",
      "zeek.ocsp.issuerNameHash",
      "zeek.ocsp.nextUpdate",
      "zeek.ocsp.revokereason",
      "zeek.ocsp.revoketime",
      "zeek.ocsp.serialNumber",
      "zeek.ocsp.thisUpdate",
      "zeek.opcua_binary.encoding_mask",
      "zeek.opcua_binary.endpoint_url",
      "zeek.opcua_binary.error",
      "zeek.opcua_binary.filter_source_link_id",
      "zeek.opcua_binary.identifier",
      "zeek.opcua_binary.identifier_str",
      "zeek.opcua_binary.is_final",
      "zeek.opcua_binary.max_chunk_cnt",
      "zeek.opcua_binary.max_msg_size",
      "zeek.opcua_binary.msg_size",
      "zeek.opcua_binary.msg_type",
      "zeek.opcua_binary.namespace_idx",
      "zeek.opcua_binary.opcua_link_id",
      "zeek.opcua_binary.operand_source_link_id",
      "zeek.opcua_binary.rcv_buf_size",
      "zeek.opcua_binary.rcv_cert",
      "zeek.opcua_binary.rcv_cert_len",
      "zeek.opcua_binary.reason",
      "zeek.opcua_binary.req_hdr_add_hdr_enc_mask",
      "zeek.opcua_binary.req_hdr_add_hdr_type_id",
      "zeek.opcua_binary.req_hdr_audit_entry_id",
      "zeek.opcua_binary.req_hdr_node_id_guid",
      "zeek.opcua_binary.req_hdr_node_id_namespace_idx",
      "zeek.opcua_binary.req_hdr_node_id_numeric",
      "zeek.opcua_binary.req_hdr_node_id_opaque",
      "zeek.opcua_binary.req_hdr_node_id_string",
      "zeek.opcua_binary.req_hdr_node_id_type",
      "zeek.opcua_binary.req_hdr_request_handle",
      "zeek.opcua_binary.req_hdr_return_diag",
      "zeek.opcua_binary.req_hdr_timeout_hint",
      "zeek.opcua_binary.req_hdr_timestamp",
      "zeek.opcua_binary.request_id",
      "zeek.opcua_binary.res_hdr_add_hdr_enc_mask",
      "zeek.opcua_binary.res_hdr_add_hdr_type_id",
      "zeek.opcua_binary.res_hdr_request_handle",
      "zeek.opcua_binary.res_hdr_service_diag_encoding",
      "zeek.opcua_binary.res_hdr_timestamp",
      "zeek.opcua_binary.sec_channel_id",
      "zeek.opcua_binary.sec_policy_uri",
      "zeek.opcua_binary.sec_policy_uri_len",
      "zeek.opcua_binary.seq_number",
      "zeek.opcua_binary.snd_buf_size",
      "zeek.opcua_binary.snd_cert",
      "zeek.opcua_binary.snd_cert_len",
      "zeek.opcua_binary.variant_source_link_id",
      "zeek.opcua_binary.version",
      "zeek.opcua_binary_activate_session.client_algorithm",
      "zeek.opcua_binary_activate_session.client_signature",
      "zeek.opcua_binary_activate_session.ext_obj_certificate_data",
      "zeek.opcua_binary_activate_session.ext_obj_encoding",
      "zeek.opcua_binary_activate_session.ext_obj_encryption_algorithom",
      "zeek.opcua_binary_activate_session.ext_obj_password",
      "zeek.opcua_binary_activate_session.ext_obj_policy_id",
      "zeek.opcua_binary_activate_session.ext_obj_token_data",
      "zeek.opcua_binary_activate_session.ext_obj_type_id_encoding_mask",
      "zeek.opcua_binary_activate_session.ext_obj_type_id_guid",
      "zeek.opcua_binary_activate_session.ext_obj_type_id_namespace_idx",
      "zeek.opcua_binary_activate_session.ext_obj_type_id_numeric",
      "zeek.opcua_binary_activate_session.ext_obj_type_id_opaque",
      "zeek.opcua_binary_activate_session.ext_obj_type_id_str",
      "zeek.opcua_binary_activate_session.ext_obj_type_id_string",
      "zeek.opcua_binary_activate_session.ext_obj_user_name",
      "zeek.opcua_binary_activate_session.server_nonce",
      "zeek.opcua_binary_activate_session.user_token_algorithm",
      "zeek.opcua_binary_activate_session.user_token_signature",
      "zeek.opcua_binary_activate_session_client_software_cert.cert_data",
      "zeek.opcua_binary_activate_session_client_software_cert.cert_signature",
      "zeek.opcua_binary_activate_session_client_software_cert.client_software_cert_link_id",
      "zeek.opcua_binary_activate_session_locale_id.local_id",
      "zeek.opcua_binary_activate_session_locale_id.opcua_locale_link_id",
      "zeek.opcua_binary_aggregate_filter.aggregate_type_encoding_mask",
      "zeek.opcua_binary_aggregate_filter.aggregate_type_guid",
      "zeek.opcua_binary_aggregate_filter.aggregate_type_namespace_idx",
      "zeek.opcua_binary_aggregate_filter.aggregate_type_numeric",
      "zeek.opcua_binary_aggregate_filter.aggregate_type_opaque",
      "zeek.opcua_binary_aggregate_filter.aggregate_type_string",
      "zeek.opcua_binary_aggregate_filter.percent_data_bad",
      "zeek.opcua_binary_aggregate_filter.percent_data_good",
      "zeek.opcua_binary_aggregate_filter.processing_interval",
      "zeek.opcua_binary_aggregate_filter.revised_percent_data_bad",
      "zeek.opcua_binary_aggregate_filter.revised_percent_data_good",
      "zeek.opcua_binary_aggregate_filter.revised_processing_interval",
      "zeek.opcua_binary_aggregate_filter.revised_start_time",
      "zeek.opcua_binary_aggregate_filter.revised_start_time_str",
      "zeek.opcua_binary_aggregate_filter.revised_treat_uncertain_as_bad",
      "zeek.opcua_binary_aggregate_filter.revised_use_server_capabilities_default",
      "zeek.opcua_binary_aggregate_filter.revised_use_slopped_extrapolation",
      "zeek.opcua_binary_aggregate_filter.start_time",
      "zeek.opcua_binary_aggregate_filter.start_time_str",
      "zeek.opcua_binary_aggregate_filter.treat_uncertain_as_bad",
      "zeek.opcua_binary_aggregate_filter.use_server_capabilities_default",
      "zeek.opcua_binary_aggregate_filter.use_slopped_extrapolation",
      "zeek.opcua_binary_browse.browse_next_release_continuation_point",
      "zeek.opcua_binary_browse.browse_service_type",
      "zeek.opcua_binary_browse.browse_view_description_timestamp",
      "zeek.opcua_binary_browse.browse_view_description_view_version",
      "zeek.opcua_binary_browse.browse_view_id_encoding_mask",
      "zeek.opcua_binary_browse.browse_view_id_guid",
      "zeek.opcua_binary_browse.browse_view_id_namespace_idx",
      "zeek.opcua_binary_browse.browse_view_id_numeric",
      "zeek.opcua_binary_browse.browse_view_id_opaque",
      "zeek.opcua_binary_browse.browse_view_id_string",
      "zeek.opcua_binary_browse.req_max_ref_nodes",
      "zeek.opcua_binary_browse_description.browse_description_encoding_mask",
      "zeek.opcua_binary_browse_description.browse_description_guid",
      "zeek.opcua_binary_browse_description.browse_description_include_subtypes",
      "zeek.opcua_binary_browse_description.browse_description_link_id",
      "zeek.opcua_binary_browse_description.browse_description_namespace_idx",
      "zeek.opcua_binary_browse_description.browse_description_numeric",
      "zeek.opcua_binary_browse_description.browse_description_opaque",
      "zeek.opcua_binary_browse_description.browse_description_ref_encoding_mask",
      "zeek.opcua_binary_browse_description.browse_description_ref_guid",
      "zeek.opcua_binary_browse_description.browse_description_ref_namespace_idx",
      "zeek.opcua_binary_browse_description.browse_description_ref_numeric",
      "zeek.opcua_binary_browse_description.browse_description_ref_opaque",
      "zeek.opcua_binary_browse_description.browse_description_ref_string",
      "zeek.opcua_binary_browse_description.browse_description_string",
      "zeek.opcua_binary_browse_description.browse_direction",
      "zeek.opcua_binary_browse_description.browse_node_class_mask",
      "zeek.opcua_binary_browse_description.browse_result_mask",
      "zeek.opcua_binary_browse_request_continuation_point.browse_next_link_id",
      "zeek.opcua_binary_browse_request_continuation_point.continuation_point",
      "zeek.opcua_binary_browse_response_references.browse_reference_link_id",
      "zeek.opcua_binary_browse_response_references.browse_response_display_name_locale",
      "zeek.opcua_binary_browse_response_references.browse_response_display_name_mask",
      "zeek.opcua_binary_browse_response_references.browse_response_display_name_text",
      "zeek.opcua_binary_browse_response_references.browse_response_is_forward",
      "zeek.opcua_binary_browse_response_references.browse_response_node_class",
      "zeek.opcua_binary_browse_response_references.browse_response_ref_encoding_mask",
      "zeek.opcua_binary_browse_response_references.browse_response_ref_guid",
      "zeek.opcua_binary_browse_response_references.browse_response_ref_name",
      "zeek.opcua_binary_browse_response_references.browse_response_ref_name_idx",
      "zeek.opcua_binary_browse_response_references.browse_response_ref_namespace_idx",
      "zeek.opcua_binary_browse_response_references.browse_response_ref_numeric",
      "zeek.opcua_binary_browse_response_references.browse_response_ref_opaque",
      "zeek.opcua_binary_browse_response_references.browse_response_ref_string",
      "zeek.opcua_binary_browse_response_references.browse_response_ref_type_encoding_mask",
      "zeek.opcua_binary_browse_response_references.browse_response_ref_type_guid",
      "zeek.opcua_binary_browse_response_references.browse_response_ref_type_namespace_idx",
      "zeek.opcua_binary_browse_response_references.browse_response_ref_type_namespace_uri",
      "zeek.opcua_binary_browse_response_references.browse_response_ref_type_numeric",
      "zeek.opcua_binary_browse_response_references.browse_response_ref_type_opaque",
      "zeek.opcua_binary_browse_response_references.browse_response_ref_type_server_idx",
      "zeek.opcua_binary_browse_response_references.browse_response_ref_type_string",
      "zeek.opcua_binary_browse_response_references.browse_response_type_def_encoding_mask",
      "zeek.opcua_binary_browse_response_references.browse_response_type_def_guid",
      "zeek.opcua_binary_browse_response_references.browse_response_type_def_namespace_idx",
      "zeek.opcua_binary_browse_response_references.browse_response_type_def_namespace_uri",
      "zeek.opcua_binary_browse_response_references.browse_response_type_def_numeric",
      "zeek.opcua_binary_browse_response_references.browse_response_type_def_opaque",
      "zeek.opcua_binary_browse_response_references.browse_response_type_def_server_idx",
      "zeek.opcua_binary_browse_response_references.browse_response_type_def_string",
      "zeek.opcua_binary_browse_result.browse_response_link_id",
      "zeek.opcua_binary_browse_result.browse_result_continuation_point",
      "zeek.opcua_binary_close_session.del_subscriptions",
      "zeek.opcua_binary_create_monitored_items.subscription_id",
      "zeek.opcua_binary_create_monitored_items.timestamps_to_return",
      "zeek.opcua_binary_create_monitored_items.timestamps_to_return_str",
      "zeek.opcua_binary_create_monitored_items_create_item.create_item_link_id",
      "zeek.opcua_binary_create_monitored_items_create_item.item_to_monitor_attribute_id",
      "zeek.opcua_binary_create_monitored_items_create_item.item_to_monitor_index_range",
      "zeek.opcua_binary_create_monitored_items_create_item.item_to_monitor_name",
      "zeek.opcua_binary_create_monitored_items_create_item.item_to_monitor_namespace_idx",
      "zeek.opcua_binary_create_monitored_items_create_item.item_to_monitor_node_id_encoding_mask",
      "zeek.opcua_binary_create_monitored_items_create_item.item_to_monitor_node_id_guid",
      "zeek.opcua_binary_create_monitored_items_create_item.item_to_monitor_node_id_namespace_idx",
      "zeek.opcua_binary_create_monitored_items_create_item.item_to_monitor_node_id_numeric",
      "zeek.opcua_binary_create_monitored_items_create_item.item_to_monitor_node_id_opaque",
      "zeek.opcua_binary_create_monitored_items_create_item.item_to_monitor_node_id_string",
      "zeek.opcua_binary_create_monitored_items_create_item.monitored_item_index_id",
      "zeek.opcua_binary_create_monitored_items_create_item.monitoring_mode",
      "zeek.opcua_binary_create_monitored_items_create_item.monitoring_parameters_client_handle",
      "zeek.opcua_binary_create_monitored_items_create_item.monitoring_parameters_discard_oldest",
      "zeek.opcua_binary_create_monitored_items_create_item.monitoring_parameters_filter_info_type_id_encoding",
      "zeek.opcua_binary_create_monitored_items_create_item.monitoring_parameters_filter_info_type_id_node_id_encoding_mask",
      "zeek.opcua_binary_create_monitored_items_create_item.monitoring_parameters_filter_info_type_id_node_id_guid",
      "zeek.opcua_binary_create_monitored_items_create_item.monitoring_parameters_filter_info_type_id_node_id_namespace_idx",
      "zeek.opcua_binary_create_monitored_items_create_item.monitoring_parameters_filter_info_type_id_node_id_numeric",
      "zeek.opcua_binary_create_monitored_items_create_item.monitoring_parameters_filter_info_type_id_node_id_opaque",
      "zeek.opcua_binary_create_monitored_items_create_item.monitoring_parameters_filter_info_type_id_node_id_string",
      "zeek.opcua_binary_create_monitored_items_create_item.monitoring_parameters_filter_info_type_id_string",
      "zeek.opcua_binary_create_monitored_items_create_item.monitoring_parameters_queue_size",
      "zeek.opcua_binary_create_monitored_items_create_item.monitoring_parameters_revised_queue_size",
      "zeek.opcua_binary_create_monitored_items_create_item.monitoring_parameters_revised_sampling_interval",
      "zeek.opcua_binary_create_monitored_items_create_item.monitoring_parameters_sampling_interval",
      "zeek.opcua_binary_create_session.algorithm",
      "zeek.opcua_binary_create_session.application_type",
      "zeek.opcua_binary_create_session.application_uri",
      "zeek.opcua_binary_create_session.auth_token_encoding_mask",
      "zeek.opcua_binary_create_session.auth_token_guid",
      "zeek.opcua_binary_create_session.auth_token_namespace_idx",
      "zeek.opcua_binary_create_session.auth_token_numeric",
      "zeek.opcua_binary_create_session.auth_token_opaque",
      "zeek.opcua_binary_create_session.auth_token_string",
      "zeek.opcua_binary_create_session.client_cert",
      "zeek.opcua_binary_create_session.client_cert_size",
      "zeek.opcua_binary_create_session.client_nonce",
      "zeek.opcua_binary_create_session.discovery_profile_uri",
      "zeek.opcua_binary_create_session.encoding_mask",
      "zeek.opcua_binary_create_session.endpoint_url",
      "zeek.opcua_binary_create_session.gateway_server_uri",
      "zeek.opcua_binary_create_session.locale",
      "zeek.opcua_binary_create_session.max_req_msg_size",
      "zeek.opcua_binary_create_session.max_res_msg_size",
      "zeek.opcua_binary_create_session.product_uri",
      "zeek.opcua_binary_create_session.req_session_timeout",
      "zeek.opcua_binary_create_session.revised_session_timeout",
      "zeek.opcua_binary_create_session.server_cert",
      "zeek.opcua_binary_create_session.server_cert_size",
      "zeek.opcua_binary_create_session.server_nonce",
      "zeek.opcua_binary_create_session.server_uri",
      "zeek.opcua_binary_create_session.session_id_encoding_mask",
      "zeek.opcua_binary_create_session.session_id_guid",
      "zeek.opcua_binary_create_session.session_id_namespace_idx",
      "zeek.opcua_binary_create_session.session_id_numeric",
      "zeek.opcua_binary_create_session.session_id_opaque",
      "zeek.opcua_binary_create_session.session_id_string",
      "zeek.opcua_binary_create_session.session_name",
      "zeek.opcua_binary_create_session.signature",
      "zeek.opcua_binary_create_session.text",
      "zeek.opcua_binary_create_session_discovery.discovery_profile_link_id",
      "zeek.opcua_binary_create_session_discovery.discovery_profile_uri",
      "zeek.opcua_binary_create_session_discovery.discovery_profile_url",
      "zeek.opcua_binary_create_session_endpoints.application_type",
      "zeek.opcua_binary_create_session_endpoints.application_uri",
      "zeek.opcua_binary_create_session_endpoints.cert_size",
      "zeek.opcua_binary_create_session_endpoints.discovery_profile_uri",
      "zeek.opcua_binary_create_session_endpoints.encoding_mask",
      "zeek.opcua_binary_create_session_endpoints.endpoint_link_id",
      "zeek.opcua_binary_create_session_endpoints.endpoint_url",
      "zeek.opcua_binary_create_session_endpoints.gateway_server_uri",
      "zeek.opcua_binary_create_session_endpoints.locale",
      "zeek.opcua_binary_create_session_endpoints.message_security_mode",
      "zeek.opcua_binary_create_session_endpoints.product_uri",
      "zeek.opcua_binary_create_session_endpoints.security_level",
      "zeek.opcua_binary_create_session_endpoints.security_policy_uri",
      "zeek.opcua_binary_create_session_endpoints.server_cert",
      "zeek.opcua_binary_create_session_endpoints.text",
      "zeek.opcua_binary_create_session_endpoints.transport_profile_uri",
      "zeek.opcua_binary_create_session_user_token.user_token_endpoint_url",
      "zeek.opcua_binary_create_session_user_token.user_token_issued_type",
      "zeek.opcua_binary_create_session_user_token.user_token_link_id",
      "zeek.opcua_binary_create_session_user_token.user_token_policy_id",
      "zeek.opcua_binary_create_session_user_token.user_token_sec_policy_uri",
      "zeek.opcua_binary_create_session_user_token.user_token_type",
      "zeek.opcua_binary_create_subscription.max_notifications_per_publish",
      "zeek.opcua_binary_create_subscription.priority",
      "zeek.opcua_binary_create_subscription.publishing_enabled",
      "zeek.opcua_binary_create_subscription.requested_lifetime_count",
      "zeek.opcua_binary_create_subscription.requested_max_keep_alive_count",
      "zeek.opcua_binary_create_subscription.requested_publishing_interval",
      "zeek.opcua_binary_create_subscription.revised_lifetime_count",
      "zeek.opcua_binary_create_subscription.revised_max_keep_alive_count",
      "zeek.opcua_binary_create_subscription.revised_publishing_interval",
      "zeek.opcua_binary_create_subscription.subscription_id",
      "zeek.opcua_binary_data_change_filter.deadband_type",
      "zeek.opcua_binary_data_change_filter.deadband_value",
      "zeek.opcua_binary_data_change_filter.trigger",
      "zeek.opcua_binary_diag_info_detail.addl_info",
      "zeek.opcua_binary_diag_info_detail.diag_info_link_id",
      "zeek.opcua_binary_diag_info_detail.has_addl_info",
      "zeek.opcua_binary_diag_info_detail.has_inner_diag_info",
      "zeek.opcua_binary_diag_info_detail.has_inner_stat_code",
      "zeek.opcua_binary_diag_info_detail.has_locale",
      "zeek.opcua_binary_diag_info_detail.has_locale_txt",
      "zeek.opcua_binary_diag_info_detail.has_namespace_uri",
      "zeek.opcua_binary_diag_info_detail.has_symbolic_id",
      "zeek.opcua_binary_diag_info_detail.inner_diag_level",
      "zeek.opcua_binary_diag_info_detail.inner_stat_code",
      "zeek.opcua_binary_diag_info_detail.locale",
      "zeek.opcua_binary_diag_info_detail.locale_str",
      "zeek.opcua_binary_diag_info_detail.locale_txt",
      "zeek.opcua_binary_diag_info_detail.locale_txt_str",
      "zeek.opcua_binary_diag_info_detail.namespace_uri",
      "zeek.opcua_binary_diag_info_detail.namespace_uri_str",
      "zeek.opcua_binary_diag_info_detail.root_object_id",
      "zeek.opcua_binary_diag_info_detail.source",
      "zeek.opcua_binary_diag_info_detail.source_str",
      "zeek.opcua_binary_diag_info_detail.symbolic_id",
      "zeek.opcua_binary_diag_info_detail.symbolic_id_str",
      "zeek.opcua_binary_event_filter_attribute_operand.alias",
      "zeek.opcua_binary_event_filter_attribute_operand.attribute",
      "zeek.opcua_binary_event_filter_attribute_operand.index_range",
      "zeek.opcua_binary_event_filter_attribute_operand.node_id_encoding_mask",
      "zeek.opcua_binary_event_filter_attribute_operand.node_id_guid",
      "zeek.opcua_binary_event_filter_attribute_operand.node_id_namespace_idx",
      "zeek.opcua_binary_event_filter_attribute_operand.node_id_numeric",
      "zeek.opcua_binary_event_filter_attribute_operand.node_id_opaque",
      "zeek.opcua_binary_event_filter_attribute_operand.node_id_string",
      "zeek.opcua_binary_event_filter_attribute_operand_browse_paths.browse_path_element_link_id",
      "zeek.opcua_binary_event_filter_attribute_operand_browse_paths.include_subtypes",
      "zeek.opcua_binary_event_filter_attribute_operand_browse_paths.is_inverse",
      "zeek.opcua_binary_event_filter_attribute_operand_browse_paths.target_name",
      "zeek.opcua_binary_event_filter_attribute_operand_browse_paths.target_name_namespace_idx",
      "zeek.opcua_binary_event_filter_attribute_operand_browse_paths.type_id_encoding_mask",
      "zeek.opcua_binary_event_filter_attribute_operand_browse_paths.type_id_guid",
      "zeek.opcua_binary_event_filter_attribute_operand_browse_paths.type_id_namespace_idx",
      "zeek.opcua_binary_event_filter_attribute_operand_browse_paths.type_id_numeric",
      "zeek.opcua_binary_event_filter_attribute_operand_browse_paths.type_id_opaque",
      "zeek.opcua_binary_event_filter_attribute_operand_browse_paths.type_id_string",
      "zeek.opcua_binary_event_filter_element_operand.element_index",
      "zeek.opcua_binary_event_filter_select_clause.attribute_id",
      "zeek.opcua_binary_event_filter_select_clause.index_range",
      "zeek.opcua_binary_event_filter_select_clause.select_clause_link_id",
      "zeek.opcua_binary_event_filter_select_clause.type_id_encoding_mask",
      "zeek.opcua_binary_event_filter_select_clause.type_id_guid",
      "zeek.opcua_binary_event_filter_select_clause.type_id_namespace_idx",
      "zeek.opcua_binary_event_filter_select_clause.type_id_numeric",
      "zeek.opcua_binary_event_filter_select_clause.type_id_opaque",
      "zeek.opcua_binary_event_filter_select_clause.type_id_string",
      "zeek.opcua_binary_event_filter_simple_attribute_operand.attribute_id",
      "zeek.opcua_binary_event_filter_simple_attribute_operand.index_range",
      "zeek.opcua_binary_event_filter_simple_attribute_operand.type_id_encoding_mask",
      "zeek.opcua_binary_event_filter_simple_attribute_operand.type_id_guid",
      "zeek.opcua_binary_event_filter_simple_attribute_operand.type_id_namespace_idx",
      "zeek.opcua_binary_event_filter_simple_attribute_operand.type_id_numeric",
      "zeek.opcua_binary_event_filter_simple_attribute_operand.type_id_opaque",
      "zeek.opcua_binary_event_filter_simple_attribute_operand.type_id_string",
      "zeek.opcua_binary_event_filter_simple_attribute_operand_browse_paths.browse_path_src",
      "zeek.opcua_binary_event_filter_simple_attribute_operand_browse_paths.name",
      "zeek.opcua_binary_event_filter_simple_attribute_operand_browse_paths.namespace_index",
      "zeek.opcua_binary_event_filter_simple_attribute_operand_browse_paths.simple_attribute_operand_browse_path_link_id",
      "zeek.opcua_binary_event_filter_where_clause.where_clause_link_id",
      "zeek.opcua_binary_event_filter_where_clause_elements.content_filter_element_link_id",
      "zeek.opcua_binary_event_filter_where_clause_elements.content_filter_filter_operand_type_id_encoding",
      "zeek.opcua_binary_event_filter_where_clause_elements.content_filter_filter_operand_type_id_node_id_encoding_mask",
      "zeek.opcua_binary_event_filter_where_clause_elements.content_filter_filter_operand_type_id_node_id_guid",
      "zeek.opcua_binary_event_filter_where_clause_elements.content_filter_filter_operand_type_id_node_id_namespace_idx",
      "zeek.opcua_binary_event_filter_where_clause_elements.content_filter_filter_operand_type_id_node_id_numeric",
      "zeek.opcua_binary_event_filter_where_clause_elements.content_filter_filter_operand_type_id_node_id_opaque",
      "zeek.opcua_binary_event_filter_where_clause_elements.content_filter_filter_operand_type_id_node_id_string",
      "zeek.opcua_binary_event_filter_where_clause_elements.content_filter_filter_operand_type_id_string",
      "zeek.opcua_binary_event_filter_where_clause_elements.filter_operator",
      "zeek.opcua_binary_get_endpoints.endpoint_url",
      "zeek.opcua_binary_get_endpoints_description.application_type",
      "zeek.opcua_binary_get_endpoints_description.application_uri",
      "zeek.opcua_binary_get_endpoints_description.cert_size",
      "zeek.opcua_binary_get_endpoints_description.discovery_profile_uri",
      "zeek.opcua_binary_get_endpoints_description.encoding_mask",
      "zeek.opcua_binary_get_endpoints_description.endpoint_description_link_id",
      "zeek.opcua_binary_get_endpoints_description.endpoint_uri",
      "zeek.opcua_binary_get_endpoints_description.gateway_server_uri",
      "zeek.opcua_binary_get_endpoints_description.locale",
      "zeek.opcua_binary_get_endpoints_description.message_security_mode",
      "zeek.opcua_binary_get_endpoints_description.product_uri",
      "zeek.opcua_binary_get_endpoints_description.security_level",
      "zeek.opcua_binary_get_endpoints_description.security_policy_uri",
      "zeek.opcua_binary_get_endpoints_description.server_cert",
      "zeek.opcua_binary_get_endpoints_description.text",
      "zeek.opcua_binary_get_endpoints_description.transport_profile_uri",
      "zeek.opcua_binary_get_endpoints_discovery.discovery_profile_link_id",
      "zeek.opcua_binary_get_endpoints_discovery.discovery_profile_url",
      "zeek.opcua_binary_get_endpoints_locale_id.locale_id",
      "zeek.opcua_binary_get_endpoints_locale_id.locale_link_id",
      "zeek.opcua_binary_get_endpoints_profile_uri.profile_uri",
      "zeek.opcua_binary_get_endpoints_profile_uri.profile_uri_link_id",
      "zeek.opcua_binary_get_endpoints_user_token.user_token_endpoint_url",
      "zeek.opcua_binary_get_endpoints_user_token.user_token_issued_type",
      "zeek.opcua_binary_get_endpoints_user_token.user_token_link_id",
      "zeek.opcua_binary_get_endpoints_user_token.user_token_policy_id",
      "zeek.opcua_binary_get_endpoints_user_token.user_token_sec_policy_uri",
      "zeek.opcua_binary_get_endpoints_user_token.user_token_type",
      "zeek.opcua_binary_opensecure_channel.client_nonce",
      "zeek.opcua_binary_opensecure_channel.client_proto_ver",
      "zeek.opcua_binary_opensecure_channel.message_security_mode",
      "zeek.opcua_binary_opensecure_channel.req_lifetime",
      "zeek.opcua_binary_opensecure_channel.sec_token_created_at",
      "zeek.opcua_binary_opensecure_channel.sec_token_id",
      "zeek.opcua_binary_opensecure_channel.sec_token_request_type",
      "zeek.opcua_binary_opensecure_channel.sec_token_revised_time",
      "zeek.opcua_binary_opensecure_channel.sec_token_sec_channel_id",
      "zeek.opcua_binary_opensecure_channel.server_nonce",
      "zeek.opcua_binary_opensecure_channel.server_proto_ver",
      "zeek.opcua_binary_read.max_age",
      "zeek.opcua_binary_read.timestamps_to_return",
      "zeek.opcua_binary_read.timestamps_to_return_str",
      "zeek.opcua_binary_read_nodes_to_read.attribute_id",
      "zeek.opcua_binary_read_nodes_to_read.attribute_id_str",
      "zeek.opcua_binary_read_nodes_to_read.data_encoding_name",
      "zeek.opcua_binary_read_nodes_to_read.data_encoding_name_idx",
      "zeek.opcua_binary_read_nodes_to_read.index_range",
      "zeek.opcua_binary_read_nodes_to_read.node_id_encoding_mask",
      "zeek.opcua_binary_read_nodes_to_read.node_id_guid",
      "zeek.opcua_binary_read_nodes_to_read.node_id_namespace_idx",
      "zeek.opcua_binary_read_nodes_to_read.node_id_numeric",
      "zeek.opcua_binary_read_nodes_to_read.node_id_opaque",
      "zeek.opcua_binary_read_nodes_to_read.node_id_string",
      "zeek.opcua_binary_read_nodes_to_read.nodes_to_read_link_id",
      "zeek.opcua_binary_read_results.data_value_encoding_mask",
      "zeek.opcua_binary_read_results.level",
      "zeek.opcua_binary_read_results.results_link_id",
      "zeek.opcua_binary_read_results.server_pico_sec",
      "zeek.opcua_binary_read_results.server_timestamp",
      "zeek.opcua_binary_read_results.source_pico_sec",
      "zeek.opcua_binary_read_results.source_timestamp",
      "zeek.opcua_binary_status_code_detail.historian_bits",
      "zeek.opcua_binary_status_code_detail.historian_bits_str",
      "zeek.opcua_binary_status_code_detail.historianextradata",
      "zeek.opcua_binary_status_code_detail.historianmultivalue",
      "zeek.opcua_binary_status_code_detail.historianpartial",
      "zeek.opcua_binary_status_code_detail.info_type",
      "zeek.opcua_binary_status_code_detail.info_type_str",
      "zeek.opcua_binary_status_code_detail.limit_bits",
      "zeek.opcua_binary_status_code_detail.limit_bits_str",
      "zeek.opcua_binary_status_code_detail.overflow",
      "zeek.opcua_binary_status_code_detail.semantics_changed",
      "zeek.opcua_binary_status_code_detail.severity",
      "zeek.opcua_binary_status_code_detail.severity_str",
      "zeek.opcua_binary_status_code_detail.source",
      "zeek.opcua_binary_status_code_detail.source_level",
      "zeek.opcua_binary_status_code_detail.source_str",
      "zeek.opcua_binary_status_code_detail.status_code",
      "zeek.opcua_binary_status_code_detail.status_code_link_id",
      "zeek.opcua_binary_status_code_detail.structure_changed",
      "zeek.opcua_binary_status_code_detail.sub_code",
      "zeek.opcua_binary_status_code_detail.sub_code_str",
      "zeek.opcua_binary_variant_array_dims.array_dim_link_id",
      "zeek.opcua_binary_variant_array_dims.dimension",
      "zeek.opcua_binary_variant_data.variant_data_encoding_name",
      "zeek.opcua_binary_variant_data.variant_data_encoding_name_idx",
      "zeek.opcua_binary_variant_data.variant_data_link_id",
      "zeek.opcua_binary_variant_data.variant_data_locale",
      "zeek.opcua_binary_variant_data.variant_data_mask",
      "zeek.opcua_binary_variant_data.variant_data_node_id_encoding_mask",
      "zeek.opcua_binary_variant_data.variant_data_node_id_guid",
      "zeek.opcua_binary_variant_data.variant_data_node_id_namespace_idx",
      "zeek.opcua_binary_variant_data.variant_data_node_id_namespace_uri",
      "zeek.opcua_binary_variant_data.variant_data_node_id_numeric",
      "zeek.opcua_binary_variant_data.variant_data_node_id_opaque",
      "zeek.opcua_binary_variant_data.variant_data_node_id_server_idx",
      "zeek.opcua_binary_variant_data.variant_data_node_id_string",
      "zeek.opcua_binary_variant_data.variant_data_text",
      "zeek.opcua_binary_variant_data.variant_data_value_decimal",
      "zeek.opcua_binary_variant_data.variant_data_value_signed_numeric",
      "zeek.opcua_binary_variant_data.variant_data_value_string",
      "zeek.opcua_binary_variant_data.variant_data_value_time",
      "zeek.opcua_binary_variant_data.variant_data_value_unsigned_numeric",
      "zeek.opcua_binary_variant_data_value.data_value_encoding_mask",
      "zeek.opcua_binary_variant_data_value.server_pico_sec",
      "zeek.opcua_binary_variant_data_value.server_timestamp",
      "zeek.opcua_binary_variant_data_value.source_pico_sec",
      "zeek.opcua_binary_variant_data_value.source_timestamp",
      "zeek.opcua_binary_variant_data_value.variant_data_value_source_link",
      "zeek.opcua_binary_variant_extension_object.ext_obj_encoding",
      "zeek.opcua_binary_variant_extension_object.ext_obj_link_id",
      "zeek.opcua_binary_variant_extension_object.ext_obj_node_id_encoding_mask",
      "zeek.opcua_binary_variant_extension_object.ext_obj_node_id_guid",
      "zeek.opcua_binary_variant_extension_object.ext_obj_node_id_namespace_idx",
      "zeek.opcua_binary_variant_extension_object.ext_obj_node_id_numeric",
      "zeek.opcua_binary_variant_extension_object.ext_obj_node_id_opaque",
      "zeek.opcua_binary_variant_extension_object.ext_obj_node_id_string",
      "zeek.opcua_binary_variant_extension_object.ext_obj_type_id_str",
      "zeek.opcua_binary_variant_metadata.built_in_data_type",
      "zeek.opcua_binary_variant_metadata.built_in_data_type_str",
      "zeek.opcua_binary_variant_metadata.dara_variant_encoding_mask",
      "zeek.opcua_binary_variant_metadata.data_variant_data_type",
      "zeek.opcua_binary_variant_metadata.data_variant_data_type_str",
      "zeek.opcua_binary_variant_metadata.variant_data_array_dim",
      "zeek.opcua_binary_variant_metadata.variant_data_source",
      "zeek.opcua_binary_variant_metadata.variant_data_source_str",
      "zeek.opcua_binary_write.node_id_encoding_mask",
      "zeek.opcua_binary_write.node_id_namespace_idx",
      "zeek.opcua_binary_write.node_id_numeric",
      "zeek.opcua_binary_write.node_id_string",
      "zeek.opcua_binary_write.node_id_guid",
      "zeek.opcua_binary_write.node_id_opaque",
      "zeek.opcua_binary_write.attribute_id",
      "zeek.opcua_binary_write.attribute_id_str",
      "zeek.opcua_binary_write.index_range",
      "zeek.opcua_binary_write.data_value_encoding_mask",
      "zeek.opcua_binary_write.source_timestamp",
      "zeek.opcua_binary_write.source_pico_sec",
      "zeek.opcua_binary_write.server_timestamp",
      "zeek.opcua_binary_write.server_pico_sec",
      "zeek.ospf.advert_router",
      "zeek.ospf.area_id",
      "zeek.ospf.backup_router",
      "zeek.ospf.desig_router",
      "zeek.ospf.dest_router_id",
      "zeek.ospf.fwd_addrs",
      "zeek.ospf.interface_id",
      "zeek.ospf.intra_prefixes",
      "zeek.ospf.link_data",
      "zeek.ospf.link_id",
      "zeek.ospf.link_prefixes",
      "zeek.ospf.link_state_id",
      "zeek.ospf.link_type",
      "zeek.ospf.lsa_type",
      "zeek.ospf.metric",
      "zeek.ospf.metrics",
      "zeek.ospf.neighbor_interface_id",
      "zeek.ospf.neighbor_router_id",
      "zeek.ospf.neighbors",
      "zeek.ospf.netmask",
      "zeek.ospf.ospf_type",
      "zeek.ospf.prefix",
      "zeek.ospf.route_tags",
      "zeek.ospf.router_id",
      "zeek.ospf.routers",
      "zeek.ospf.version",
      "zeek.pe.compile_ts",
      "zeek.pe.has_cert_table",
      "zeek.pe.has_debug_data",
      "zeek.pe.has_export_table",
      "zeek.pe.has_import_table",
      "zeek.pe.is_64bit",
      "zeek.pe.is_exe",
      "zeek.pe.machine",
      "zeek.pe.os",
      "zeek.pe.section_names",
      "zeek.pe.subsystem",
      "zeek.pe.uses_aslr",
      "zeek.pe.uses_code_integrity",
      "zeek.pe.uses_dep",
      "zeek.pe.uses_seh",
      "zeek.profinet.block_version",
      "zeek.profinet.index",
      "zeek.profinet.operation_type",
      "zeek.profinet.slot_number",
      "zeek.profinet.subslot_number",
      "zeek.profinet_dce_rpc.activity_uuid",
      "zeek.profinet_dce_rpc.interface_uuid",
      "zeek.profinet_dce_rpc.object_uuid",
      "zeek.profinet_dce_rpc.operation",
      "zeek.profinet_dce_rpc.packet_type",
      "zeek.profinet_dce_rpc.server_boot_time",
      "zeek.profinet_dce_rpc.version",
      "zeek.profinet_io_cm.rpc_version",
      "zeek.profinet_io_cm.packet_type",
      "zeek.profinet_io_cm.reserved_for_impl_1",
      "zeek.profinet_io_cm.last_fragment",
      "zeek.profinet_io_cm.fragment",
      "zeek.profinet_io_cm.no_fragment_requested",
      "zeek.profinet_io_cm.maybe",
      "zeek.profinet_io_cm.idempotent",
      "zeek.profinet_io_cm.broadcast",
      "zeek.profinet_io_cm.reserved_for_impl_2",
      "zeek.profinet_io_cm.cancel_was_pending_at_call_end",
      "zeek.profinet_io_cm.integer_encoding",
      "zeek.profinet_io_cm.character_encoding",
      "zeek.profinet_io_cm.floating_point_encoding",
      "zeek.profinet_io_cm.serial_high",
      "zeek.profinet_io_cm.object_uuid",
      "zeek.profinet_io_cm.interface_uuid",
      "zeek.profinet_io_cm.activity_uuid",
      "zeek.profinet_io_cm.server_boot_time",
      "zeek.profinet_io_cm.uuid_version",
      "zeek.profinet_io_cm.sequence_num",
      "zeek.profinet_io_cm.operation_num",
      "zeek.profinet_io_cm.interface_hint",
      "zeek.profinet_io_cm.activity_hint",
      "zeek.profinet_io_cm.len_of_body",
      "zeek.profinet_io_cm.fragment_num",
      "zeek.profinet_io_cm.auth_protocol",
      "zeek.profinet_io_cm.serial_low",
      "zeek.profinet_io_cm.vers_fack",
      "zeek.profinet_io_cm.window_size",
      "zeek.profinet_io_cm.max_tsdu",
      "zeek.profinet_io_cm.max_frag_size",
      "zeek.profinet_io_cm.serial_number",
      "zeek.profinet_io_cm.sel_ack_len",
      "zeek.profinet_io_cm.sel_ack",
      "zeek.radius.connect_info",
      "zeek.radius.framed_addr",
      "zeek.radius.mac",
      "zeek.radius.reply_msg",
      "zeek.radius.result",
      "zeek.radius.ttl",
      "zeek.radius.tunnel_client",
      "zeek.rdp.cert_count",
      "zeek.rdp.cert_permanent",
      "zeek.rdp.cert_type",
      "zeek.rdp.client_build",
      "zeek.rdp.client_channels",
      "zeek.rdp.client_dig_product_id",
      "zeek.rdp.client_name",
      "zeek.rdp.cookie",
      "zeek.rdp.desktop_height",
      "zeek.rdp.desktop_width",
      "zeek.rdp.encryption_level",
      "zeek.rdp.encryption_method",
      "zeek.rdp.keyboard_layout",
      "zeek.rdp.requested_color_depth",
      "zeek.rdp.result",
      "zeek.rdp.security_protocol",
      "zeek.rfb.auth",
      "zeek.rfb.authentication_method",
      "zeek.rfb.client_major_version",
      "zeek.rfb.client_minor_version",
      "zeek.rfb.desktop_name",
      "zeek.rfb.height",
      "zeek.rfb.server_major_version",
      "zeek.rfb.server_minor_version",
      "zeek.rfb.share_flag",
      "zeek.rfb.width",
      "zeek.s7comm.error_class",
      "zeek.s7comm.error_code",
      "zeek.s7comm.function_code",
      "zeek.s7comm.function_name",
      "zeek.s7comm.pdu_reference",
      "zeek.s7comm.rosctr_code",
      "zeek.s7comm.rosctr_name",
      "zeek.s7comm.subfunction_code",
      "zeek.s7comm.subfunction_name",
      "zeek.s7comm_plus.function_code",
      "zeek.s7comm_plus.function_name",
      "zeek.s7comm_plus.opcode",
      "zeek.s7comm_plus.opcode_name",
      "zeek.s7comm_plus.version",
      "zeek.s7comm_read_szl.method",
      "zeek.s7comm_read_szl.return_code",
      "zeek.s7comm_read_szl.return_code_name",
      "zeek.s7comm_read_szl.szl_id",
      "zeek.s7comm_read_szl.szl_id_name",
      "zeek.s7comm_read_szl.szl_index",
      "zeek.s7comm_upload_download.block_number",
      "zeek.s7comm_upload_download.block_type",
      "zeek.s7comm_upload_download.blocklength",
      "zeek.s7comm_upload_download.destination_filesystem",
      "zeek.s7comm_upload_download.filename",
      "zeek.s7comm_upload_download.function_name",
      "zeek.s7comm_upload_download.function_status",
      "zeek.s7comm_upload_download.rosctr_name",
      "zeek.s7comm_upload_download.session_id",
      "zeek.signatures.event_message",
      "zeek.signatures.hits.Capa",
      "zeek.signatures.hits.ClamAV",
      "zeek.signatures.hits.Yara",
      "zeek.signatures.host_count",
      "zeek.signatures.note",
      "zeek.signatures.signature_count",
      "zeek.signatures.signature_id",
      "zeek.signatures.sub_message",
      "zeek.sip.call_id",
      "zeek.sip.content_type",
      "zeek.sip.date",
      "zeek.sip.method",
      "zeek.sip.reply_to",
      "zeek.sip.request_body_len",
      "zeek.sip.request_from",
      "zeek.sip.request_path",
      "zeek.sip.request_to",
      "zeek.sip.response_body_len",
      "zeek.sip.response_from",
      "zeek.sip.response_path",
      "zeek.sip.response_to",
      "zeek.sip.seq",
      "zeek.sip.status_code",
      "zeek.sip.status_msg",
      "zeek.sip.subject",
      "zeek.sip.trans_depth",
      "zeek.sip.uri",
      "zeek.sip.user_agent",
      "zeek.sip.version",
      "zeek.sip.warning",
      "zeek.smb_cmd.argument",
      "zeek.smb_cmd.command",
      "zeek.smb_cmd.rtt",
      "zeek.smb_cmd.status",
      "zeek.smb_cmd.sub_command",
      "zeek.smb_cmd.tree",
      "zeek.smb_cmd.tree_service",
      "zeek.smb_cmd.user",
      "zeek.smb_cmd.version",
      "zeek.smb_files.action",
      "zeek.smb_files.data_len_req",
      "zeek.smb_files.data_len_rsp",
      "zeek.smb_files.data_offset_req",
      "zeek.smb_files.name",
      "zeek.smb_files.orig_h",
      "zeek.smb_files.orig_p",
      "zeek.smb_files.path",
      "zeek.smb_files.prev_name",
      "zeek.smb_files.resp_h",
      "zeek.smb_files.resp_p",
      "zeek.smb_files.size",
      "zeek.smb_files.times_accessed",
      "zeek.smb_files.times_changed",
      "zeek.smb_files.times_created",
      "zeek.smb_files.times_modified",
      "zeek.smb_files.ts",
      "zeek.smb_mapping.native_file_system",
      "zeek.smb_mapping.path",
      "zeek.smb_mapping.resource_type",
      "zeek.smb_mapping.share_type",
      "zeek.smtp.cc",
      "zeek.smtp.date",
      "zeek.smtp.first_received",
      "zeek.smtp.from",
      "zeek.smtp.helo",
      "zeek.smtp.in_reply_to",
      "zeek.smtp.is_webmail",
      "zeek.smtp.last_reply",
      "zeek.smtp.last_reply_code",
      "zeek.smtp.last_reply_msg",
      "zeek.smtp.mailfrom",
      "zeek.smtp.msg_id",
      "zeek.smtp.path",
      "zeek.smtp.rcptto",
      "zeek.smtp.reply_to",
      "zeek.smtp.second_received",
      "zeek.smtp.subject",
      "zeek.smtp.tls",
      "zeek.smtp.to",
      "zeek.smtp.trans_depth",
      "zeek.smtp.user_agent",
      "zeek.smtp.x_originating_ip",
      "zeek.snmp.community",
      "zeek.snmp.display_string",
      "zeek.snmp.duration",
      "zeek.snmp.get_bulk_requests",
      "zeek.snmp.get_requests",
      "zeek.snmp.get_responses",
      "zeek.snmp.set_requests",
      "zeek.snmp.up_since",
      "zeek.snmp.version",
      "zeek.socks.bound_host",
      "zeek.socks.bound_name",
      "zeek.socks.bound_port",
      "zeek.socks.request_host",
      "zeek.socks.request_name",
      "zeek.socks.request_port",
      "zeek.socks.server_status",
      "zeek.socks.version",
      "zeek.software.name",
      "zeek.software.software_type",
      "zeek.software.unparsed_version",
      "zeek.software.url",
      "zeek.software.version_addl",
      "zeek.software.version_major",
      "zeek.software.version_minor",
      "zeek.software.version_minor2",
      "zeek.software.version_minor3",
      "zeek.ssh.auth_attempts",
      "zeek.ssh.auth_success",
      "zeek.ssh.cipher_alg",
      "zeek.ssh.client",
      "zeek.ssh.compression_alg",
      "zeek.ssh.cshka",
      "zeek.ssh.direction",
      "zeek.ssh.hassh",
      "zeek.ssh.hasshAlgorithms",
      "zeek.ssh.hasshServer",
      "zeek.ssh.hasshServerAlgorithms",
      "zeek.ssh.hasshVersion",
      "zeek.ssh.host_key",
      "zeek.ssh.host_key_alg",
      "zeek.ssh.ja4ssh",
      "zeek.ssh.kex_alg",
      "zeek.ssh.mac_alg",
      "zeek.ssh.remote_location_city",
      "zeek.ssh.remote_location_country_code",
      "zeek.ssh.remote_location_latitude",
      "zeek.ssh.remote_location_longitude",
      "zeek.ssh.remote_location_region",
      "zeek.ssh.server",
      "zeek.ssh.sshka",
      "zeek.ssh.version",
      "zeek.ssl.cert_chain_fps",
      "zeek.ssl.cert_chain_fuids",
      "zeek.ssl.cipher",
      "zeek.ssl.client_cert_chain_fps",
      "zeek.ssl.client_cert_chain_fuids",
      "zeek.ssl.client_issuer.C",
      "zeek.ssl.client_issuer.CN",
      "zeek.ssl.client_issuer.DC",
      "zeek.ssl.client_issuer.emailAddress",
      "zeek.ssl.client_issuer.GN",
      "zeek.ssl.client_issuer.initials",
      "zeek.ssl.client_issuer.L",
      "zeek.ssl.client_issuer.O",
      "zeek.ssl.client_issuer.OU",
      "zeek.ssl.client_issuer.pseudonym",
      "zeek.ssl.client_issuer.serialNumber",
      "zeek.ssl.client_issuer.SN",
      "zeek.ssl.client_issuer.ST",
      "zeek.ssl.client_issuer.title",
      "zeek.ssl.client_issuer_full",
      "zeek.ssl.client_subject.C",
      "zeek.ssl.client_subject.CN",
      "zeek.ssl.client_subject.emailAddress",
      "zeek.ssl.client_subject.GN",
      "zeek.ssl.client_subject.initials",
      "zeek.ssl.client_subject.L",
      "zeek.ssl.client_subject.O",
      "zeek.ssl.client_subject.OU",
      "zeek.ssl.client_subject.pseudonym",
      "zeek.ssl.client_subject.serialNumber",
      "zeek.ssl.client_subject.SN",
      "zeek.ssl.client_subject.ST",
      "zeek.ssl.client_subject.title",
      "zeek.ssl.client_subject_full",
      "zeek.ssl.curve",
      "zeek.ssl.established",
      "zeek.ssl.issuer.C",
      "zeek.ssl.issuer.CN",
      "zeek.ssl.issuer.DC",
      "zeek.ssl.issuer.emailAddress",
      "zeek.ssl.issuer.GN",
      "zeek.ssl.issuer.initials",
      "zeek.ssl.issuer.L",
      "zeek.ssl.issuer.O",
      "zeek.ssl.issuer.OU",
      "zeek.ssl.issuer.pseudonym",
      "zeek.ssl.issuer.serialNumber",
      "zeek.ssl.issuer.SN",
      "zeek.ssl.issuer.ST",
      "zeek.ssl.issuer.title",
      "zeek.ssl.issuer_full",
      "zeek.ssl.last_alert",
      "zeek.ssl.next_protocol",
      "zeek.ssl.resumed",
      "zeek.ssl.server_name",
      "zeek.ssl.sni_matches_cert",
      "zeek.ssl.ssl_history",
      "zeek.ssl.ssl_version",
      "zeek.ssl.subject.C",
      "zeek.ssl.subject.CN",
      "zeek.ssl.subject.description",
      "zeek.ssl.subject.emailAddress",
      "zeek.ssl.subject.GN",
      "zeek.ssl.subject.initials",
      "zeek.ssl.subject.L",
      "zeek.ssl.subject.O",
      "zeek.ssl.subject.OU",
      "zeek.ssl.subject.postalCode",
      "zeek.ssl.subject.pseudonym",
      "zeek.ssl.subject.serialNumber",
      "zeek.ssl.subject.SN",
      "zeek.ssl.subject.ST",
      "zeek.ssl.subject.street",
      "zeek.ssl.subject.title",
      "zeek.ssl.subject_full",
      "zeek.ssl.validation_status",
      "zeek.stun.attr_type",
      "zeek.stun.attr_val",
      "zeek.stun.class",
      "zeek.stun.method",
      "zeek.stun.trans_id",
      "zeek.stun_nat.lan_addr",
      "zeek.stun_nat.wan_addr",
      "zeek.stun_nat.wan_port",
      "zeek.synchrophasor.data_frame_count",
      "zeek.synchrophasor.data_rate",
      "zeek.synchrophasor.data_stream_id",
      "zeek.synchrophasor.frame_size",
      "zeek.synchrophasor.frame_size_max",
      "zeek.synchrophasor.frame_size_min",
      "zeek.synchrophasor.frame_size_tot",
      "zeek.synchrophasor.frame_type",
      "zeek.synchrophasor.header_time_stamp",
      "zeek.synchrophasor.history",
      "zeek.synchrophasor.version",
      "zeek.synchrophasor_cfg.cfg_frame_id",
      "zeek.synchrophasor_cfg.cont_idx",
      "zeek.synchrophasor_cfg.pmu_count_actual",
      "zeek.synchrophasor_cfg.pmu_count_expected",
      "zeek.synchrophasor_cfg_detail.analog_conv_analog_flags",
      "zeek.synchrophasor_cfg_detail.analog_conv_mag_scale",
      "zeek.synchrophasor_cfg_detail.analog_conv_offset",
      "zeek.synchrophasor_cfg_detail.analog_conv_user_defined_scaling",
      "zeek.synchrophasor_cfg_detail.analog_format",
      "zeek.synchrophasor_cfg_detail.annam",
      "zeek.synchrophasor_cfg_detail.annmr",
      "zeek.synchrophasor_cfg_detail.cfg_frame_id",
      "zeek.synchrophasor_cfg_detail.cfgcnt",
      "zeek.synchrophasor_cfg_detail.data_source_id",
      "zeek.synchrophasor_cfg_detail.dgnam",
      "zeek.synchrophasor_cfg_detail.dgnmr",
      "zeek.synchrophasor_cfg_detail.digital_conv_normal_status_mask",
      "zeek.synchrophasor_cfg_detail.digital_conv_valid_inputs_mask",
      "zeek.synchrophasor_cfg_detail.fnom",
      "zeek.synchrophasor_cfg_detail.freq_format",
      "zeek.synchrophasor_cfg_detail.global_pmuid",
      "zeek.synchrophasor_cfg_detail.group_delay",
      "zeek.synchrophasor_cfg_detail.phasor_conv_angle_adj",
      "zeek.synchrophasor_cfg_detail.phasor_conv_calibration_mag_adj",
      "zeek.synchrophasor_cfg_detail.phasor_conv_calibration_phas_adj",
      "zeek.synchrophasor_cfg_detail.phasor_conv_downsampled_fir_filter",
      "zeek.synchrophasor_cfg_detail.phasor_conv_downsampled_no_fir_filter",
      "zeek.synchrophasor_cfg_detail.phasor_conv_downsampled_reselection",
      "zeek.synchrophasor_cfg_detail.phasor_conv_filtered_without_changing_sampling",
      "zeek.synchrophasor_cfg_detail.phasor_conv_mod_appl",
      "zeek.synchrophasor_cfg_detail.phasor_conv_phasor_component",
      "zeek.synchrophasor_cfg_detail.phasor_conv_phasor_type",
      "zeek.synchrophasor_cfg_detail.phasor_conv_phunit",
      "zeek.synchrophasor_cfg_detail.phasor_conv_phvalue",
      "zeek.synchrophasor_cfg_detail.phasor_conv_pseudo_phasor_val",
      "zeek.synchrophasor_cfg_detail.phasor_conv_rotation_phase_adj",
      "zeek.synchrophasor_cfg_detail.phasor_conv_scale_factor",
      "zeek.synchrophasor_cfg_detail.phasor_conv_upsampled_extrapolation",
      "zeek.synchrophasor_cfg_detail.phasor_conv_upsampled_interpolation",
      "zeek.synchrophasor_cfg_detail.phasor_conv_user_def",
      "zeek.synchrophasor_cfg_detail.phasor_format",
      "zeek.synchrophasor_cfg_detail.phasor_shape",
      "zeek.synchrophasor_cfg_detail.phnam",
      "zeek.synchrophasor_cfg_detail.phnmr",
      "zeek.synchrophasor_cfg_detail.pmu_elev",
      "zeek.synchrophasor_cfg_detail.pmu_idx",
      "zeek.synchrophasor_cfg_detail.pmu_lat",
      "zeek.synchrophasor_cfg_detail.pmu_lon",
      "zeek.synchrophasor_cfg_detail.station_name",
      "zeek.synchrophasor_cfg_detail.svc_class",
      "zeek.synchrophasor_cfg_detail.window",
      "zeek.synchrophasor_cmd.command",
      "zeek.synchrophasor_cmd.extframe",
      "zeek.synchrophasor_data.data_frame_id",
      "zeek.synchrophasor_data.pmu_count_actual",
      "zeek.synchrophasor_data.pmu_count_expected",
      "zeek.synchrophasor_data_detail.analog_data",
      "zeek.synchrophasor_data_detail.config_change",
      "zeek.synchrophasor_data_detail.data_error_indicator",
      "zeek.synchrophasor_data_detail.data_frame_id",
      "zeek.synchrophasor_data_detail.data_modified",
      "zeek.synchrophasor_data_detail.data_sorting_type",
      "zeek.synchrophasor_data_detail.digital",
      "zeek.synchrophasor_data_detail.est_polar_angle",
      "zeek.synchrophasor_data_detail.est_polar_magnitude",
      "zeek.synchrophasor_data_detail.est_rectangular_imaginary",
      "zeek.synchrophasor_data_detail.est_rectangular_real",
      "zeek.synchrophasor_data_detail.freq_dev_mhz",
      "zeek.synchrophasor_data_detail.pmu_idx",
      "zeek.synchrophasor_data_detail.pmu_sync_error",
      "zeek.synchrophasor_data_detail.pmu_time_quality",
      "zeek.synchrophasor_data_detail.pmu_trigger_pickup",
      "zeek.synchrophasor_data_detail.rocof",
      "zeek.synchrophasor_data_detail.trigger_reason",
      "zeek.synchrophasor_data_detail.unlocked_time",
      "zeek.synchrophasor_hdr.data",
      "zeek.syslog.facility",
      "zeek.syslog.message",
      "zeek.syslog.severity",
      "zeek.tds.command",
      "zeek.tds_rpc.parameter",
      "zeek.tds_rpc.procedure_name",
      "zeek.tds_sql_batch.header_type",
      "zeek.tds_sql_batch.query",
      "zeek.tftp.block_acked",
      "zeek.tftp.block_sent",
      "zeek.tftp.error_code",
      "zeek.tftp.error_msg",
      "zeek.tftp.fname",
      "zeek.tftp.mode",
      "zeek.tftp.size",
      "zeek.tftp.uid_data",
      "zeek.tftp.wrq",
      "zeek.ts",
      "zeek.tunnel.action",
      "zeek.tunnel.tunnel_type",
      "zeek.uid",
      "zeek.websocket.host",
      "zeek.websocket.uri",
      "zeek.websocket.user_agent",
      "zeek.websocket.subprotocol",
      "zeek.websocket.client_protocols",
      "zeek.websocket.server_extensions",
      "zeek.websocket.client_extensions",
      "zeek.weird.addl",
      "zeek.weird.notice",
      "zeek.weird.source",
      "zeek.wireguard.established",
      "zeek.wireguard.initiations",
      "zeek.wireguard.receiver_index",
      "zeek.wireguard.responses",
      "zeek.wireguard.sender_index",
      "zeek.x509.basic_constraints_ca",
      "zeek.x509.basic_constraints_path_len",
      "zeek.x509.certificate_curve",
      "zeek.x509.certificate_exponent",
      "zeek.x509.certificate_issuer.C",
      "zeek.x509.certificate_issuer.CN",
      "zeek.x509.certificate_issuer.DC",
      "zeek.x509.certificate_issuer.emailAddress",
      "zeek.x509.certificate_issuer.GN",
      "zeek.x509.certificate_issuer.initials",
      "zeek.x509.certificate_issuer.L",
      "zeek.x509.certificate_issuer.name",
      "zeek.x509.certificate_issuer.O",
      "zeek.x509.certificate_issuer.OU",
      "zeek.x509.certificate_issuer.postalCode",
      "zeek.x509.certificate_issuer.pseudonym",
      "zeek.x509.certificate_issuer.serialNumber",
      "zeek.x509.certificate_issuer.SN",
      "zeek.x509.certificate_issuer.ST",
      "zeek.x509.certificate_issuer.street",
      "zeek.x509.certificate_issuer.title",
      "zeek.x509.certificate_issuer_full",
      "zeek.x509.certificate_key_alg",
      "zeek.x509.certificate_key_length",
      "zeek.x509.certificate_key_type",
      "zeek.x509.certificate_not_valid_after",
      "zeek.x509.certificate_not_valid_before",
      "zeek.x509.certificate_serial",
      "zeek.x509.certificate_sig_alg",
      "zeek.x509.certificate_subject.businessCategory",
      "zeek.x509.certificate_subject.C",
      "zeek.x509.certificate_subject.CN",
      "zeek.x509.certificate_subject.DC",
      "zeek.x509.certificate_subject.description",
      "zeek.x509.certificate_subject.emailAddress",
      "zeek.x509.certificate_subject.GN",
      "zeek.x509.certificate_subject.initials",
      "zeek.x509.certificate_subject.jurisdictionC",
      "zeek.x509.certificate_subject.jurisdictionST",
      "zeek.x509.certificate_subject.L",
      "zeek.x509.certificate_subject.name",
      "zeek.x509.certificate_subject.O",
      "zeek.x509.certificate_subject.OU",
      "zeek.x509.certificate_subject.postalCode",
      "zeek.x509.certificate_subject.pseudonym",
      "zeek.x509.certificate_subject.serialNumber",
      "zeek.x509.certificate_subject.SN",
      "zeek.x509.certificate_subject.ST",
      "zeek.x509.certificate_subject.street",
      "zeek.x509.certificate_subject.title",
      "zeek.x509.certificate_subject_full",
      "zeek.x509.certificate_version",
      "zeek.x509.client_cert",
      "zeek.x509.fingerprint",
      "zeek.x509.host_cert",
      "zeek.x509.san_dns",
      "zeek.x509.san_email",
      "zeek.x509.san_ip",
      "zeek.x509.san_uri"
    ];
    var allFieldsStr = allFields.join(',');

    // add URL link for NetBox URLs
    var netboxUrlStr = allFields.filter(value => /^(source|destination)\.(device|segment)\.url$/i.test(value)).join(',');
    this.api.addValueAction("malcolm_netbox_url", { name: "NetBox", url: '%TEXT%', fields: netboxUrlStr });

    // add URL link for assigned transport protocol numbers
    var protoFieldsStr = allFields.filter(value => /^(network\.transport|ip\.protocol)$/i.test(value)).join(',');
    this.api.addValueAction("malcolm_websearch_proto_v", { name: "Protocol Registry", url: 'https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml', fields: protoFieldsStr });
    this.api.addFieldAction("malcolm_websearch_proto_f", { name: "Protocol Registry", url: 'https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml', fields: protoFieldsStr });

    // add right-click for searching IANA for services
    var serviceFieldsStr = allFields.filter(value => /^(protocols?|network\.protocol)$/i.test(value)).join(',');
    this.api.addValueAction("malcolm_websearch_service", { name: "Service Registry", url: 'https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=%TEXT%', fields: serviceFieldsStr });

    // add right-click for searching VirusTotal for other IP addresses
    var ipFieldsStr = allFields.filter(value => /[_\.-](h|ip)$/i.test(value)).join(',');
    this.api.addValueAction("malcolm_websearch_ip", { name: "VirusTotal IP", url: "https://www.virustotal.com/en/ip-address/%TEXT%/information", fields: ipFieldsStr });

    // add right-click for searching IANA for ports
    var portFieldsStr = allFields.filter(value => /(^|src|dst|source|dest|destination|[\b_\.-])p(ort)?s?$/i.test(value)).join(',');
    this.api.addValueAction("malcolm_websearch_port", { name: "Port Registry", url: 'https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=%TEXT%', fields: portFieldsStr });
    this.api.addValueAction("malcolm_websearch_port_arkime", { name: "Port Registry", url: 'https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=%TEXT%', category: "port" });

    // add right-click for searching VirusTotal for hash signatures
    var hashFieldsStr = allFields.filter(value => /(^|[\b_\.-])(md5|sha(1|256|384|512))\b/i.test(value)).join(',');
    this.api.addValueAction("malcolm_vt_fields_hash", { name: "VirusTotal Hash", url: "https://www.virustotal.com/gui/file/%TEXT%/detection", fields: hashFieldsStr });
    this.api.addValueAction("malcolm_vt_fields_hash_arkime", { name: "VirusTotal Hash", url: "https://www.virustotal.com/gui/file/%TEXT%/detection", category: "md5" });

    // add right-click for searching the web for signature IDs
    var sigFieldsStr = allFields.filter(value => /(^|[\b_\.-])(hit|signature(_?id))?s?$/i.test(value)).join(',');
    this.api.addValueAction("malcolm_websearch_sig", { name: "Web Search", url: 'https://duckduckgo.com/?q="%TEXT%"', fields: sigFieldsStr });

    // add right-click for searching ARIN for ASN
    var asnFieldsStr = allFields.filter(value => /(as\.number|(src|dst)ASN|asn\.(src|dst))$/i.test(value)).join(',');
    this.api.addValueAction("malcolm_websearch_asn", { name: "ARIN ASN", url: 'https://search.arin.net/rdap/?query=%TEXT%&searchFilter=asn', fields: asnFieldsStr });

    // add right-click for searching mime/media/content types
    var mimeFieldsStr = allFields.filter(value => /mime[_\.-]?type/i.test(value)).join(',');
    this.api.addValueAction("malcolm_websearch_mime", { name: "Media Type Registry", url: 'https://www.iana.org/assignments/media-types/%TEXT%', fields: mimeFieldsStr });

    // add right-click for extracted files from zeek
    // var carvedFieldsStr = allFields.filter(value => /^zeek\.files\.extracted$/i.test(value)).join(',');
    // this.api.addValueAction("malcolm_carved_file", { name: "Download", url: "/extracted-files/%TEXT%", fields: carvedFieldsStr });
    var carvedFieldsUrlStr = allFields.filter(value => /^zeek\.files\.extracted_uri$/i.test(value)).join(',');
    this.api.addValueAction("malcolm_carved_file_url", { name: "Download", url: "/%TEXT%", fields: carvedFieldsUrlStr });

    // add right-clicks for pivoting into dashboards from Arkime (see nginx.conf)
    var filterLabel = "OpenSearch Dashboards %DBFIELD%";
    var filterUrl = "idark2dash/filter?start=%ISOSTART%&stop=%ISOSTOP%&field=%DBFIELD%&value=%TEXT%";
    this.api.addValueAction("malcolm_dashboards_fields_zeek", { name: filterLabel, url: filterUrl, all: true });

    // add rick-click for opening malcolm agg api
    var apiLabel = "Aggregate %DBFIELD%";
    var apiURL = "/mapi/agg/%DBFIELD%?from=%ISOSTART%&to=%ISOSTOP%";
    this.api.addFieldAction("malcolm_mapi_fields_zeek", { name: apiLabel, url: apiURL, all: true });

    // add right-click for viewing original JSON document
    this.api.addValueAction("malcolm_json_source", { name: "%DBFIELD% Document(s) JSON", url: "/mapi/document?filter={\"%DBFIELD%\":\"%TEXT%\"}", fields: "communityId,event.id,id,network.community_id,rootId,zeek.fuid,zeek.uid" });

    this.api.addView("malcolm_common",
      "if (session.event.hash)\n" +

      // id and basic connection information
      "  div.sessionDetailMeta.bold Malcolm Common Fields\n" +
      "  dl.sessionDetailMeta(suffix=\"IDs and Basic Connection Info\")\n" +
      "    +arrayList(session.event, 'id', 'Log ID', 'event.id')\n" +
      "    +arrayList(session.event, 'hash', 'Log Hash', 'event.hash')\n" +
      "    +arrayList(session.network, 'community_id', 'Connection Community ID', 'network.community_id')\n" +
      "    +arrayList(session.event, 'provider', 'Data Source', 'event.provider')\n" +
      "    +arrayList(session.event, 'dataset', 'Log Type', 'event.dataset')\n" +
      "    +arrayList(session.event, 'module', 'Data  Source Module', 'event.module')\n" +
      "    +arrayList(session.host, 'name', 'Malcolm Node', 'host.name')\n" +
      "    +arrayList(session.network, 'transport', 'Protocol', 'network.transport')\n" +
      "    +arrayList(session.network, 'protocol', 'Service', 'network.protocol')\n" +
      "    +arrayList(session.network, 'protocol_version', 'Service Version', 'network.protocol_version')\n" +
      "    +arrayList(session.event, 'action', 'Action', 'event.action')\n" +
      "    +arrayList(session.event, 'result', 'Result', 'event.result')\n" +
      "    +arrayList(session.event, 'severity_tags', 'Severity Tags', 'event.severity_tags')\n" +
      "    +arrayList(session.event, 'severity', 'Severity', 'event.severity')\n" +
      "    +arrayList(session.event, 'risk_score', 'Risk Score', 'event.risk_score')\n" +
      "    +arrayList(session.rule, 'category', 'Event Category', 'rule.category')\n" +
      "    +arrayList(session.rule, 'name', 'Event Name', 'rule.name')\n" +
      "    +arrayList(session.rule, 'id', 'Rule ID', 'rule.id')\n" +
      "    +arrayList(session.vulnerability, 'category', 'Vulnerability Category', 'vulnerability.category')\n" +
      "    +arrayList(session.vulnerability, 'enumeration', 'Vulnerability Enumeration', 'vulnerability.enumeration')\n" +
      "    +arrayList(session.vulnerability, 'id', 'Vulnerability ID', 'vulnerability.id')\n" +
      "    +arrayList(session.network, 'direction', 'Direction', 'network.direction')\n" +
      "    +arrayList(session.network, 'is_orig', 'Is Originator', 'network.is_orig')\n" +
      "    +arrayList(session.source, 'ip', 'Originating Host', 'source.ip')\n" +
      "    +arrayList(session.source, 'port', 'Originating Port', 'source.port')\n" +
      "    +arrayList(session.source, 'mac', 'Originating MAC', 'source.mac')\n" +
      "    +arrayList(session.source, 'oui', 'Originating OUI', 'source.oui')\n" +
      "    +arrayList(session.source, 'ip_reverse_dns', 'Originating Host rDNS', 'source.ip_reverse_dns')\n" +
      "    +arrayList(session.source.geo, 'country_name', 'Originating GeoIP Country', 'source.geo.country_name')\n" +
      "    +arrayList(session.source.geo, 'city_name', 'Originating GeoIP City', 'source.geo.city_name')\n" +
      "    +arrayList(session.destination, 'ip', 'Responding Host', 'destination.ip')\n" +
      "    +arrayList(session.destination, 'port', 'Responding Port', 'destination.port')\n" +
      "    +arrayList(session.destination, 'mac', 'Responding MAC', 'destination.mac')\n" +
      "    +arrayList(session.destination, 'oui', 'Responding OUI', 'destination.oui')\n" +
      "    +arrayList(session.destination, 'ip_reverse_dns', 'Responding Host rDNS', 'destination.ip_reverse_dns')\n" +
      "    +arrayList(session.destination.geo, 'country_name', 'Responding GeoIP Country', 'destination.geo.country_name')\n" +
      "    +arrayList(session.destination.geo, 'city_name', 'Responding GeoIP City', 'destination.geo.city_name')\n" +
      "    +arrayList(session.related, 'ip', 'Related IP', 'related.ip')\n" +
      "    +arrayList(session.related, 'mac', 'Related MAC', 'related.mac')\n" +
      "    +arrayList(session.related, 'oui', 'Related OUI', 'related.oui')\n" +
      "    +arrayList(session.related, 'hosts', 'Related Host', 'related.hosts')\n" +
      "    +arrayList(session.related, 'user', 'User', 'related.user')\n" +
      "    +arrayList(session.related, 'password', 'Password', 'related.password')\n" +
      "    +arrayList(session.user_agent, 'original', 'User Agent', 'user_agent.original')\n" +
      "    +arrayList(session.event, 'freq_score_v1', 'Freq Score v1', 'event.freq_score_v1')\n" +
      "    +arrayList(session.event, 'freq_score_v2', 'Freq Score v2', 'event.freq_score_v2')\n" +
      "    +arrayList(session.file, 'path', 'File Path', 'file.path')\n" +
      "    +arrayList(session.file, 'mime_type', 'File Magic', 'file.mime_type')\n" +
      "    +arrayList(session.file, 'source', 'File Transport', 'file.source')\n" +
      "    +arrayList(session.related, 'hash', 'Related Hash', 'related.hash')\n");
  }
}

// ----------------------------------------------------------------------------
exports.initSource = function (api) {
  api.addSourceConfigDef('malcolm', {
    singleton: true,
    name: 'malcolm',
    description: 'Log fields for Arkime as part of Malcolm',
    link: 'https://github.com/idaholab/malcolm',
    types: [],
    cacheable: false,
    displayable: true,
    fields: []
  });

  return new MalcolmSource(api, 'malcolm');
};