{
  "_meta": {
    "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-threat.html",
    "ecs_version": "8.7.0-dev"
  },
  "template": {
    "mappings": {
      "properties": {
        "threat": {
          "properties": {
            "enrichments": {
              "properties": {
                "indicator": {
                  "properties": {
                    "as": {
                      "properties": {
                        "number": {
                          "type": "long"
                        },
                        "organization": {
                          "properties": {
                            "name": {
                              "fields": {
                                "text": {
                                  "type": "match_only_text"
                                }
                              },
                              "ignore_above": 1024,
                              "type": "keyword"
                            }
                          }
                        }
                      }
                    },
                    "confidence": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "description": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "email": {
                      "properties": {
                        "address": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        }
                      }
                    },
                    "file": {
                      "properties": {
                        "accessed": {
                          "type": "date"
                        },
                        "attributes": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "code_signature": {
                          "properties": {
                            "digest_algorithm": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "exists": {
                              "type": "boolean"
                            },
                            "signing_id": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "status": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "subject_name": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "team_id": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "timestamp": {
                              "type": "date"
                            },
                            "trusted": {
                              "type": "boolean"
                            },
                            "valid": {
                              "type": "boolean"
                            }
                          }
                        },
                        "created": {
                          "type": "date"
                        },
                        "ctime": {
                          "type": "date"
                        },
                        "device": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "directory": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "drive_letter": {
                          "ignore_above": 1,
                          "type": "keyword"
                        },
                        "elf": {
                          "properties": {
                            "architecture": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "byte_order": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "cpu_type": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "creation_date": {
                              "type": "date"
                            },
                            "exports": {
                              "type": "flattened"
                            },
                            "go_import_hash": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "go_imports": {
                              "type": "flattened"
                            },
                            "go_imports_names_entropy": {
                              "type": "long"
                            },
                            "go_imports_names_var_entropy": {
                              "type": "long"
                            },
                            "go_stripped": {
                              "type": "boolean"
                            },
                            "header": {
                              "properties": {
                                "abi_version": {
                                  "ignore_above": 1024,
                                  "type": "keyword"
                                },
                                "class": {
                                  "ignore_above": 1024,
                                  "type": "keyword"
                                },
                                "data": {
                                  "ignore_above": 1024,
                                  "type": "keyword"
                                },
                                "entrypoint": {
                                  "type": "long"
                                },
                                "object_version": {
                                  "ignore_above": 1024,
                                  "type": "keyword"
                                },
                                "os_abi": {
                                  "ignore_above": 1024,
                                  "type": "keyword"
                                },
                                "type": {
                                  "ignore_above": 1024,
                                  "type": "keyword"
                                },
                                "version": {
                                  "ignore_above": 1024,
                                  "type": "keyword"
                                }
                              }
                            },
                            "import_hash": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "imports": {
                              "type": "flattened"
                            },
                            "imports_names_entropy": {
                              "type": "long"
                            },
                            "imports_names_var_entropy": {
                              "type": "long"
                            },
                            "sections": {
                              "properties": {
                                "chi2": {
                                  "type": "long"
                                },
                                "entropy": {
                                  "type": "long"
                                },
                                "flags": {
                                  "ignore_above": 1024,
                                  "type": "keyword"
                                },
                                "name": {
                                  "ignore_above": 1024,
                                  "type": "keyword"
                                },
                                "physical_offset": {
                                  "ignore_above": 1024,
                                  "type": "keyword"
                                },
                                "physical_size": {
                                  "type": "long"
                                },
                                "type": {
                                  "ignore_above": 1024,
                                  "type": "keyword"
                                },
                                "var_entropy": {
                                  "type": "long"
                                },
                                "virtual_address": {
                                  "type": "long"
                                },
                                "virtual_size": {
                                  "type": "long"
                                }
                              },
                              "type": "nested"
                            },
                            "segments": {
                              "properties": {
                                "sections": {
                                  "ignore_above": 1024,
                                  "type": "keyword"
                                },
                                "type": {
                                  "ignore_above": 1024,
                                  "type": "keyword"
                                }
                              },
                              "type": "nested"
                            },
                            "shared_libraries": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "telfhash": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            }
                          }
                        },
                        "extension": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "fork_name": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "gid": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "group": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "hash": {
                          "properties": {
                            "md5": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "sha1": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "sha256": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "sha384": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "sha512": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "ssdeep": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "tlsh": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            }
                          }
                        },
                        "inode": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "mime_type": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "mode": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "mtime": {
                          "type": "date"
                        },
                        "name": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "owner": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "path": {
                          "fields": {
                            "text": {
                              "type": "match_only_text"
                            }
                          },
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "pe": {
                          "properties": {
                            "architecture": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "company": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "description": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "file_version": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "go_import_hash": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "go_imports": {
                              "type": "flattened"
                            },
                            "go_imports_names_entropy": {
                              "type": "long"
                            },
                            "go_imports_names_var_entropy": {
                              "type": "long"
                            },
                            "go_stripped": {
                              "type": "boolean"
                            },
                            "imphash": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "import_hash": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "imports": {
                              "type": "flattened"
                            },
                            "imports_names_entropy": {
                              "type": "long"
                            },
                            "imports_names_var_entropy": {
                              "type": "long"
                            },
                            "original_file_name": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "pehash": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "product": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "sections": {
                              "properties": {
                                "entropy": {
                                  "type": "long"
                                },
                                "name": {
                                  "ignore_above": 1024,
                                  "type": "keyword"
                                },
                                "physical_size": {
                                  "type": "long"
                                },
                                "var_entropy": {
                                  "type": "long"
                                },
                                "virtual_size": {
                                  "type": "long"
                                }
                              },
                              "type": "nested"
                            }
                          }
                        },
                        "size": {
                          "type": "long"
                        },
                        "target_path": {
                          "fields": {
                            "text": {
                              "type": "match_only_text"
                            }
                          },
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "type": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "uid": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "x509": {
                          "properties": {
                            "alternative_names": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "issuer": {
                              "properties": {
                                "common_name": {
                                  "ignore_above": 1024,
                                  "type": "keyword"
                                },
                                "country": {
                                  "ignore_above": 1024,
                                  "type": "keyword"
                                },
                                "distinguished_name": {
                                  "ignore_above": 1024,
                                  "type": "keyword"
                                },
                                "locality": {
                                  "ignore_above": 1024,
                                  "type": "keyword"
                                },
                                "organization": {
                                  "ignore_above": 1024,
                                  "type": "keyword"
                                },
                                "organizational_unit": {
                                  "ignore_above": 1024,
                                  "type": "keyword"
                                },
                                "state_or_province": {
                                  "ignore_above": 1024,
                                  "type": "keyword"
                                }
                              }
                            },
                            "not_after": {
                              "type": "date"
                            },
                            "not_before": {
                              "type": "date"
                            },
                            "public_key_algorithm": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "public_key_curve": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "public_key_exponent": {
                              "doc_values": false,
                              "index": false,
                              "type": "long"
                            },
                            "public_key_size": {
                              "type": "long"
                            },
                            "serial_number": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "signature_algorithm": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "subject": {
                              "properties": {
                                "common_name": {
                                  "ignore_above": 1024,
                                  "type": "keyword"
                                },
                                "country": {
                                  "ignore_above": 1024,
                                  "type": "keyword"
                                },
                                "distinguished_name": {
                                  "ignore_above": 1024,
                                  "type": "keyword"
                                },
                                "locality": {
                                  "ignore_above": 1024,
                                  "type": "keyword"
                                },
                                "organization": {
                                  "ignore_above": 1024,
                                  "type": "keyword"
                                },
                                "organizational_unit": {
                                  "ignore_above": 1024,
                                  "type": "keyword"
                                },
                                "state_or_province": {
                                  "ignore_above": 1024,
                                  "type": "keyword"
                                }
                              }
                            },
                            "version_number": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            }
                          }
                        }
                      }
                    },
                    "first_seen": {
                      "type": "date"
                    },
                    "geo": {
                      "properties": {
                        "city_name": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "continent_code": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "continent_name": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "country_iso_code": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "country_name": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "location": {
                          "type": "geo_point"
                        },
                        "name": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "postal_code": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "region_iso_code": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "region_name": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "timezone": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        }
                      }
                    },
                    "ip": {
                      "type": "ip"
                    },
                    "last_seen": {
                      "type": "date"
                    },
                    "marking": {
                      "properties": {
                        "tlp": {
                          "properties": {
                            "version": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            }
                          }
                        }
                      }
                    },
                    "modified_at": {
                      "type": "date"
                    },
                    "port": {
                      "type": "long"
                    },
                    "provider": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "reference": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "registry": {
                      "properties": {
                        "data": {
                          "properties": {
                            "bytes": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "strings": {
                              "type": "wildcard"
                            },
                            "type": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            }
                          }
                        },
                        "hive": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "key": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "path": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "value": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        }
                      }
                    },
                    "scanner_stats": {
                      "type": "long"
                    },
                    "sightings": {
                      "type": "long"
                    },
                    "type": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "url": {
                      "properties": {
                        "domain": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "extension": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "fragment": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "full": {
                          "fields": {
                            "text": {
                              "type": "match_only_text"
                            }
                          },
                          "type": "wildcard"
                        },
                        "original": {
                          "fields": {
                            "text": {
                              "type": "match_only_text"
                            }
                          },
                          "type": "wildcard"
                        },
                        "password": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "path": {
                          "type": "wildcard"
                        },
                        "port": {
                          "type": "long"
                        },
                        "query": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "registered_domain": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "scheme": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "subdomain": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "top_level_domain": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "username": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        }
                      }
                    },
                    "x509": {
                      "properties": {
                        "alternative_names": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "issuer": {
                          "properties": {
                            "common_name": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "country": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "distinguished_name": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "locality": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "organization": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "organizational_unit": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "state_or_province": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            }
                          }
                        },
                        "not_after": {
                          "type": "date"
                        },
                        "not_before": {
                          "type": "date"
                        },
                        "public_key_algorithm": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "public_key_curve": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "public_key_exponent": {
                          "doc_values": false,
                          "index": false,
                          "type": "long"
                        },
                        "public_key_size": {
                          "type": "long"
                        },
                        "serial_number": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "signature_algorithm": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "subject": {
                          "properties": {
                            "common_name": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "country": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "distinguished_name": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "locality": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "organization": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "organizational_unit": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "state_or_province": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            }
                          }
                        },
                        "version_number": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        }
                      }
                    }
                  },
                  "type": "object"
                },
                "matched": {
                  "properties": {
                    "atomic": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "field": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "id": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "index": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "occurred": {
                      "type": "date"
                    },
                    "type": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                }
              },
              "type": "nested"
            },
            "feed": {
              "properties": {
                "dashboard_id": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "description": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "reference": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "framework": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "group": {
              "properties": {
                "alias": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "id": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "reference": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "indicator": {
              "properties": {
                "as": {
                  "properties": {
                    "number": {
                      "type": "long"
                    },
                    "organization": {
                      "properties": {
                        "name": {
                          "fields": {
                            "text": {
                              "type": "match_only_text"
                            }
                          },
                          "ignore_above": 1024,
                          "type": "keyword"
                        }
                      }
                    }
                  }
                },
                "confidence": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "description": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "email": {
                  "properties": {
                    "address": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                },
                "file": {
                  "properties": {
                    "accessed": {
                      "type": "date"
                    },
                    "attributes": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "code_signature": {
                      "properties": {
                        "digest_algorithm": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "exists": {
                          "type": "boolean"
                        },
                        "signing_id": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "status": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "subject_name": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "team_id": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "timestamp": {
                          "type": "date"
                        },
                        "trusted": {
                          "type": "boolean"
                        },
                        "valid": {
                          "type": "boolean"
                        }
                      }
                    },
                    "created": {
                      "type": "date"
                    },
                    "ctime": {
                      "type": "date"
                    },
                    "device": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "directory": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "drive_letter": {
                      "ignore_above": 1,
                      "type": "keyword"
                    },
                    "elf": {
                      "properties": {
                        "architecture": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "byte_order": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "cpu_type": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "creation_date": {
                          "type": "date"
                        },
                        "exports": {
                          "type": "flattened"
                        },
                        "go_import_hash": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "go_imports": {
                          "type": "flattened"
                        },
                        "go_imports_names_entropy": {
                          "type": "long"
                        },
                        "go_imports_names_var_entropy": {
                          "type": "long"
                        },
                        "go_stripped": {
                          "type": "boolean"
                        },
                        "header": {
                          "properties": {
                            "abi_version": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "class": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "data": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "entrypoint": {
                              "type": "long"
                            },
                            "object_version": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "os_abi": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "type": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "version": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            }
                          }
                        },
                        "import_hash": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "imports": {
                          "type": "flattened"
                        },
                        "imports_names_entropy": {
                          "type": "long"
                        },
                        "imports_names_var_entropy": {
                          "type": "long"
                        },
                        "sections": {
                          "properties": {
                            "chi2": {
                              "type": "long"
                            },
                            "entropy": {
                              "type": "long"
                            },
                            "flags": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "name": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "physical_offset": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "physical_size": {
                              "type": "long"
                            },
                            "type": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "var_entropy": {
                              "type": "long"
                            },
                            "virtual_address": {
                              "type": "long"
                            },
                            "virtual_size": {
                              "type": "long"
                            }
                          },
                          "type": "nested"
                        },
                        "segments": {
                          "properties": {
                            "sections": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "type": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            }
                          },
                          "type": "nested"
                        },
                        "shared_libraries": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "telfhash": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        }
                      }
                    },
                    "extension": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "fork_name": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "gid": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "group": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "hash": {
                      "properties": {
                        "md5": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "sha1": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "sha256": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "sha384": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "sha512": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "ssdeep": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "tlsh": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        }
                      }
                    },
                    "inode": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "mime_type": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "mode": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "mtime": {
                      "type": "date"
                    },
                    "name": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "owner": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "path": {
                      "fields": {
                        "text": {
                          "type": "match_only_text"
                        }
                      },
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "pe": {
                      "properties": {
                        "architecture": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "company": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "description": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "file_version": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "go_import_hash": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "go_imports": {
                          "type": "flattened"
                        },
                        "go_imports_names_entropy": {
                          "type": "long"
                        },
                        "go_imports_names_var_entropy": {
                          "type": "long"
                        },
                        "go_stripped": {
                          "type": "boolean"
                        },
                        "imphash": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "import_hash": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "imports": {
                          "type": "flattened"
                        },
                        "imports_names_entropy": {
                          "type": "long"
                        },
                        "imports_names_var_entropy": {
                          "type": "long"
                        },
                        "original_file_name": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "pehash": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "product": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "sections": {
                          "properties": {
                            "entropy": {
                              "type": "long"
                            },
                            "name": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "physical_size": {
                              "type": "long"
                            },
                            "var_entropy": {
                              "type": "long"
                            },
                            "virtual_size": {
                              "type": "long"
                            }
                          },
                          "type": "nested"
                        }
                      }
                    },
                    "size": {
                      "type": "long"
                    },
                    "target_path": {
                      "fields": {
                        "text": {
                          "type": "match_only_text"
                        }
                      },
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "type": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "uid": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "x509": {
                      "properties": {
                        "alternative_names": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "issuer": {
                          "properties": {
                            "common_name": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "country": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "distinguished_name": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "locality": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "organization": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "organizational_unit": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "state_or_province": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            }
                          }
                        },
                        "not_after": {
                          "type": "date"
                        },
                        "not_before": {
                          "type": "date"
                        },
                        "public_key_algorithm": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "public_key_curve": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "public_key_exponent": {
                          "doc_values": false,
                          "index": false,
                          "type": "long"
                        },
                        "public_key_size": {
                          "type": "long"
                        },
                        "serial_number": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "signature_algorithm": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "subject": {
                          "properties": {
                            "common_name": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "country": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "distinguished_name": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "locality": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "organization": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "organizational_unit": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            },
                            "state_or_province": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            }
                          }
                        },
                        "version_number": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        }
                      }
                    }
                  }
                },
                "first_seen": {
                  "type": "date"
                },
                "geo": {
                  "properties": {
                    "city_name": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "continent_code": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "continent_name": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "country_iso_code": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "country_name": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "location": {
                      "type": "geo_point"
                    },
                    "name": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "postal_code": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "region_iso_code": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "region_name": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "timezone": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                },
                "ip": {
                  "type": "ip"
                },
                "last_seen": {
                  "type": "date"
                },
                "marking": {
                  "properties": {
                    "tlp": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                },
                "modified_at": {
                  "type": "date"
                },
                "port": {
                  "type": "long"
                },
                "provider": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "reference": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "registry": {
                  "properties": {
                    "data": {
                      "properties": {
                        "bytes": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "strings": {
                          "type": "wildcard"
                        },
                        "type": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        }
                      }
                    },
                    "hive": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "key": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "path": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "value": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                },
                "scanner_stats": {
                  "type": "long"
                },
                "sightings": {
                  "type": "long"
                },
                "type": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "url": {
                  "properties": {
                    "domain": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "extension": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "fragment": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "full": {
                      "fields": {
                        "text": {
                          "type": "match_only_text"
                        }
                      },
                      "type": "wildcard"
                    },
                    "original": {
                      "fields": {
                        "text": {
                          "type": "match_only_text"
                        }
                      },
                      "type": "wildcard"
                    },
                    "password": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "path": {
                      "type": "wildcard"
                    },
                    "port": {
                      "type": "long"
                    },
                    "query": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "registered_domain": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "scheme": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "subdomain": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "top_level_domain": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "username": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                },
                "x509": {
                  "properties": {
                    "alternative_names": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "issuer": {
                      "properties": {
                        "common_name": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "country": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "distinguished_name": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "locality": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "organization": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "organizational_unit": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "state_or_province": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        }
                      }
                    },
                    "not_after": {
                      "type": "date"
                    },
                    "not_before": {
                      "type": "date"
                    },
                    "public_key_algorithm": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "public_key_curve": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "public_key_exponent": {
                      "doc_values": false,
                      "index": false,
                      "type": "long"
                    },
                    "public_key_size": {
                      "type": "long"
                    },
                    "serial_number": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "signature_algorithm": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "subject": {
                      "properties": {
                        "common_name": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "country": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "distinguished_name": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "locality": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "organization": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "organizational_unit": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        },
                        "state_or_province": {
                          "ignore_above": 1024,
                          "type": "keyword"
                        }
                      }
                    },
                    "version_number": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                }
              }
            },
            "software": {
              "properties": {
                "alias": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "id": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "platforms": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "reference": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "type": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "tactic": {
              "properties": {
                "id": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "reference": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "technique": {
              "properties": {
                "id": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "name": {
                  "fields": {
                    "text": {
                      "type": "match_only_text"
                    }
                  },
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "reference": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "subtechnique": {
                  "properties": {
                    "id": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "name": {
                      "fields": {
                        "text": {
                          "type": "match_only_text"
                        }
                      },
                      "ignore_above": 1024,
                      "type": "keyword"
                    },
                    "reference": {
                      "ignore_above": 1024,
                      "type": "keyword"
                    }
                  }
                }
              }
            },
            "threat": {
              "properties": {
                "indicator": {
                  "properties": {
                    "marking": {
                      "properties": {
                        "tlp": {
                          "properties": {
                            "version": {
                              "ignore_above": 1024,
                              "type": "keyword"
                            }
                          }
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}
