Chronicle Unified Data Model

This document contains a generated list of all supported Chronicle UDM Fields and their descriptions pulled from the underlying schema. Chronicle's own documentation on this list exists on the chronicle-documentation site.

Some fields that exist within UDM are arrays, these are marked with a [n] to annotate this. If a field type is of the type Enum it is required that you select a value from the table of possible enum's.

Depending on the metadata.event_type that is selected there are additional required fields depending on the event type. Chronicle has documented these required fields on the chronicle-documentation site.