docs/ref/modules/syscollector/events.md
This document describes the event formats generated by the Syscollector module in Wazuh. These events use Wazuh's custom field structure for inventory data.
All Syscollector events share a common structure based on the component type:
{
"data":
{
"checksum": "26db1e87e1cb563512707363adeabaecdd7ae11a",
"item_id": "c3cbf3edb7c5565edb919ccb2475845270839642",
"scan_time": "2025/09/18 13:45:48",
// ... component-specific fields
},
"operation": "INSERTED",
"type": "dbsync_network_iface"
}
Generated when hardware configuration changes.
board_serial - Motherboard serial numbercpu_name - CPU model namecpu_cores - Number of CPU corescpu_mhz - CPU frequency in MHzram_total - Total RAM in KBram_free - Available RAM in KBram_usage - Used RAM percentage{
"data":
{
"board_serial": "0",
"checksum": "752e394b1d19ba29ca3fef9df2c96c0cbf0374af",
"cpu_cores": 8,
"cpu_mhz": 3800.0,
"cpu_name": "AMD Ryzen 7 5800X 8-Core Processor",
"ram_free": 14077916,
"ram_total": 16375868,
"ram_usage": 15,
"scan_time": "2025/09/18 13:46:04"
},
"operation": "MODIFIED",
"type": "dbsync_hwinfo"
}
Generated when OS information changes.
hostname - System hostnamearchitecture - System architecture (x86_64, arm64, etc.)os_name - Operating system nameos_major - OS major version numberos_minor - OS minor version numberos_codename - OS codename/release nameos_platform - OS platform identifieros_version - Complete OS version stringrelease - Kernel release versionsysname - System name (Linux, Windows, etc.)version - Detailed kernel/OS version{
"data":
{
"architecture": "x86_64",
"checksum": "1758203148259835853",
"hostname": "noble",
"os_codename": "noble",
"os_major": "24",
"os_minor": "04",
"os_name": "Ubuntu",
"os_platform": "ubuntu",
"os_version": "24.04 LTS (Noble Numbat)",
"release": "6.8.0-31-generic",
"scan_time": "2025/09/18 13:45:48",
"sysname": "Linux",
"version": "#31-Ubuntu SMP PREEMPT_DYNAMIC Sat Apr 20 00:40:06 UTC 2024"
},
"operation": "INSERTED",
"type": "dbsync_osinfo"
}
Generated when software packages are installed, updated, or removed.
name - Package nameversion - Package versionvendor - Software vendorformat - Package format (deb, rpm, msi, etc.)architecture - Architecture (amd64, x86_64, etc.)size - Package size in bytesdescription - Package descriptioninstall_time - Installation timestamplocation - Installation pathpriority - Package prioritygroups - Package category/groupsource - Source package namemultiarch - Multi-architecture support{
"data":
{
"architecture": "all",
"checksum": "b72f2ddac7476f3c54b26d3ec28b8f68d9cfed7e",
"description": "JavaScript support for Sphinx documentation",
"format": "deb",
"groups": "javascript",
"install_time": " ",
"item_id": "5780194be938f3784d9a135d89a8931b8b4b9fb0",
"location": " ",
"multiarch": "foreign",
"name": "libjs-sphinxdoc",
"priority": "optional",
"scan_time": "2025/09/18 13:45:48",
"size": 204800,
"source": "sphinx",
"vendor": "Debian Python Team",
"version": "7.2.6-6"
},
"operation": "INSERTED",
"type": "dbsync_packages"
}
Generated when network interface configuration changes.
name - Interface nameadapter - Adapter identifiertype - Interface typestate - Interface state (up/down)mtu - Maximum transmission unitmac - MAC addresstx_packets - Transmitted packetsrx_packets - Received packetstx_bytes - Transmitted bytesrx_bytes - Received bytestx_errors - Transmission errorsrx_errors - Reception errorstx_dropped - Dropped transmissionsrx_dropped - Dropped receptions{
"data":
{
"checksum": "9f354e321cea8beb065c4d426535796929f9e42f",
"item_id": "689c849c40783292622ce604316663b0c766f6f5",
"mac": "08:00:27:d4:46:39",
"mtu": 1500,
"name": "eth1",
"rx_bytes": 3745889,
"rx_dropped": 0,
"rx_errors": 0,
"rx_packets": 18227,
"scan_time": "2025/09/18 13:45:48",
"state": "up",
"tx_bytes": 8219746,
"tx_dropped": 0,
"tx_errors": 0,
"tx_packets": 18547,
"type": "ethernet"
},
"operation": "INSERTED",
"type": "dbsync_network_iface"
}
Generated when network address configuration changes.
iface - Interface nameproto - Protocol (0=ipv4, 1=ipv6)address - IP addressnetmask - Network maskbroadcast - Broadcast address{
"data":
{
"address": "10.0.2.15",
"broadcast": "10.0.2.255",
"checksum": "05d2d949e2507040eafacffeb3c9d91dd8d4f5dc",
"iface": "eth0",
"item_id": "e499c93734efd5b7664bdd6f17a40f56b178b82d",
"netmask": "255.255.255.0",
"proto": 0,
"scan_time": "2025/09/18 13:45:48"
},
"operation": "INSERTED",
"type": "dbsync_network_address"
}
Generated when network protocol configuration changes.
iface - Interface nametype - Protocol type (ipv4/ipv6)gateway - Gateway addressdhcp - DHCP status (enabled/disabled/unknown)metric - Route metric{
"data":
{
"checksum": "8203e61612bcec28e1c741b30f2f124803155885",
"dhcp": "unknown",
"gateway": "10.0.2.2",
"iface": "eth0",
"item_id": "f19629d858393054b7075ec6db3d778db7f18f30",
"metric": "100",
"scan_time": "2025/09/18 13:45:48",
"type": "ipv4"
},
"operation": "INSERTED",
"type": "dbsync_network_protocol"
}
Generated when network ports are opened or closed.
protocol - Network protocol (tcp, tcp6, udp, udp6)local_ip - Local IP addresslocal_port - Local port numberremote_ip - Remote IP addressremote_port - Remote port numbertx_queue - Transmit queue sizerx_queue - Receive queue sizeinode - Socket inodestate - Connection statepid - Process ID using the portprocess - Process name using the port{
"data":
{
"checksum": "761a502a9150d7cd0e0baacc1ca182e245ed0916",
"inode": 13615,
"item_id": "8d27e3fd98724c60cf0de4534927ad584f1eb691",
"local_ip": "::ffff:192.168.56.132",
"local_port": 22,
"pid": 2249,
"process": "sshd",
"protocol": "tcp6",
"remote_ip": "::ffff:192.168.56.1",
"remote_port": 60524,
"rx_queue": 0,
"scan_time": "2025/09/18 13:45:48",
"state": "established",
"tx_queue": 0
},
"operation": "INSERTED",
"type": "dbsync_ports"
}
Generated when processes start or stop.
pid - Process IDname - Process namecmd - Full command lineargvs - Command line argumentsstate - Process stateppid - Parent process IDeuser - Effective userruser - Real usersuser - Saved useregroup - Effective grouprgroup - Real groupsgroup - Saved groupfgroup - File system grouppriority - Process prioritynice - Nice valuesize - Process sizevm_size - Virtual memory sizeresident - Resident memoryshare - Shared memorystart_time - Process start timeutime - User CPU timestime - System CPU timepgrp - Process group IDsession - Session IDnlwp - Number of threadstgid - Thread group IDtty - Controlling terminalprocessor - Processor number{
"data":
{
"argvs": "-n -iNONE",
"checksum": "6280d8a41e0fad04bcc33bf088abdbfde8921196",
"cmd": "/usr/sbin/rsyslogd",
"egroup": "syslog",
"euser": "syslog",
"fgroup": "syslog",
"name": "rsyslogd",
"nice": 0,
"nlwp": 4,
"pgrp": 819,
"pid": "819",
"ppid": 1,
"priority": 20,
"processor": 1,
"resident": 5504,
"rgroup": "syslog",
"ruser": "syslog",
"scan_time": "2025/09/18 13:45:48",
"session": 819,
"sgroup": "syslog",
"share": 1088,
"size": 55627,
"start_time": 1758196941,
"state": "S",
"stime": 3,
"suser": "syslog",
"tgid": 819,
"tty": 0,
"utime": 2,
"vm_size": 222508
},
"operation": "INSERTED",
"type": "dbsync_processes"
}
Generated when system user accounts are created, modified, or removed.
user_name - Usernameuser_full_name - Full/display nameuser_home - Home directory pathuser_id - User ID (UID)user_uid_signed - Signed user IDuser_uuid - User UUID (macOS/Windows)user_groups - Group memberships (colon-separated)user_group_id - Primary group IDuser_group_id_signed - Signed primary group IDuser_created - Account creation timestampuser_shell - Login shelluser_type - User account typeuser_is_hidden - Hidden account flaguser_is_remote - Remote account flaguser_last_login - Last login timestampuser_password_status - Password statususer_password_expiration_date - Password expiration dateuser_password_hash_algorithm - Password hash algorithmuser_password_inactive_days - Password inactive daysuser_password_last_change - Password last change timestampuser_password_max_days_between_changes - Maximum days between password changesuser_password_min_days_between_changes - Minimum days between password changesuser_password_warning_days_before_expiration - Warning days before expirationuser_roles - User rolesuser_auth_failed_count - Failed authentication countuser_auth_failed_timestamp - Last failed authentication timestamphost_ip - Host IP addresslogin_status - Login statuslogin_tty - Login terminallogin_type - Login typeprocess_pid - Associated process ID{
"data":
{
"checksum": "ef86b3fa5116219b74d0e6edeefb39f067ff1802",
"host_ip": "0.0.0.0",
"login_status": 1,
"login_tty": "pts/0",
"login_type": "user",
"process_pid": 12561,
"scan_time": "2025/09/18 13:45:48",
"user_auth_failed_count": 0,
"user_auth_failed_timestamp": 0,
"user_created": 0,
"user_full_name": "vagrant",
"user_group_id": 1000,
"user_group_id_signed": 1000,
"user_groups": "vagrant:adm:cdrom:sudo:dip:plugdev:lxd",
"user_home": "/home/vagrant",
"user_id": 1000,
"user_is_hidden": 0,
"user_is_remote": 1,
"user_last_login": 1758203148,
"user_name": "vagrant",
"user_password_expiration_date": -1,
"user_password_hash_algorithm": "6",
"user_password_inactive_days": -1,
"user_password_last_change": 1714348800.0,
"user_password_max_days_between_changes": 99999,
"user_password_min_days_between_changes": 0,
"user_password_status": "active",
"user_password_warning_days_before_expiration": 7,
"user_roles": " ",
"user_shell": "/bin/bash",
"user_type": " ",
"user_uid_signed": 1000,
"user_uuid": " "
},
"operation": "INSERTED",
"type": "dbsync_users"
}
Generated when system groups are created, modified, or removed.
group_name - Group namegroup_description - Group descriptiongroup_id - Group ID (GID)group_id_signed - Signed group IDgroup_users - Group member list (colon-separated)group_is_hidden - Hidden group flaggroup_uuid - Group UUID{
"data":
{
"checksum": "ec4e94eb67532b00fcebaf4fb710d981b2a91cd5",
"group_description": " ",
"group_id": 1,
"group_id_signed": 1,
"group_is_hidden": 0,
"group_name": "daemon",
"group_users": "daemon:pollinate:vboxadd",
"group_uuid": " ",
"scan_time": "2025/09/18 13:45:48"
},
"operation": "INSERTED",
"type": "dbsync_groups"
}
Generated when system services change state or configuration.
service_name - Service nameservice_description - Service descriptionservice_type - Service typeservice_state - Current state (active, inactive, etc.)service_sub_state - Sub-state (running, dead, etc.)service_enabled - Enabled at boot (enabled, disabled, static)service_start_type - Start typeservice_id - Service identifierservice_object_path - D-Bus object pathservice_restart - Restart policyservice_address - Service addressservice_exit_code - Exit codeservice_win32_exit_code - Windows exit codeservice_frequency - Service frequencyservice_inetd_compatibility - Inetd compatibility flagservice_starts_on_mount - Starts on mount flagservice_starts_on_not_empty_directory - Starts on non-empty directoryservice_starts_on_path_modified - Starts on path modifiedservice_target_address - Target addressservice_target_ephemeral_id - Target ephemeral IDprocess_pid - Process ID if runningprocess_executable - Executable pathprocess_args - Process argumentsprocess_group_name - Process group nameprocess_root_directory - Process root directoryprocess_working_directory - Process working directoryfile_path - Service file pathlog_file_path - Log file patherror_log_file_path - Error log file path{
"data":
{
"checksum": "b92cd9cc0b7f874b7338532288a53dacf5ed23dd",
"error_log_file_path": " ",
"file_path": " ",
"item_id": "9a73e5bdbac23fedd77a4ad2a16064d0c61d4d68",
"log_file_path": " ",
"process_args": " ",
"process_executable": "/usr/lib/systemd/system/rescue.target",
"process_group_name": " ",
"process_pid": 0,
"process_root_directory": " ",
"process_working_directory": " ",
"scan_time": "2025/09/18 13:45:48",
"service_address": " ",
"service_description": "Rescue Mode",
"service_enabled": "static",
"service_exit_code": 0,
"service_frequency": 0,
"service_id": "rescue.target",
"service_inetd_compatibility": 0,
"service_name": "rescue.target",
"service_object_path": "/org/freedesktop/systemd1/unit/rescue_2etarget",
"service_restart": " ",
"service_start_type": " ",
"service_starts_on_mount": 0,
"service_starts_on_not_empty_directory": " ",
"service_starts_on_path_modified": " ",
"service_state": "inactive",
"service_sub_state": "dead",
"service_target_address": "/",
"service_target_ephemeral_id": 0,
"service_type": " ",
"service_win32_exit_code": 0
},
"operation": "INSERTED",
"type": "dbsync_services"
}
Generated when browser extensions are installed, updated, or removed.
browser_name - Browser name (chrome, firefox, etc.)browser_profile_name - Browser profile namebrowser_profile_path - Browser profile pathbrowser_profile_referenced - Profile referenced flagpackage_name - Extension namepackage_id - Extension IDpackage_version - Extension versionpackage_description - Extension descriptionpackage_path - Extension installation pathpackage_enabled - Extension enabled statuspackage_from_webstore - Installed from official storepackage_autoupdate - Auto-update enabledpackage_build_version - Build versionpackage_installed - Installation timestamppackage_permissions - Extension permissionspackage_persistent - Persistent extension flagpackage_reference - Update reference URLpackage_type - Extension typepackage_visible - Visible extension flagfile_hash_sha256 - Extension file hashuser_id - User who owns the extension{
"data":
{
"browser_name": "chrome",
"browser_profile_name": "Nico Wazuh",
"browser_profile_path": "/home/nbertoldo/.config/google-chrome/Profile 1",
"browser_profile_referenced": 1,
"checksum": "14143035a3724acb40173cc51f514d3cbdd871ff",
"file_hash_sha256": "f52f39015be44f6be8a3a73dcd87cd9a01e1520f1983b4adfc6d4dd0cc22838e",
"item_id": "76e2a99717f0d59594b300116a6238d62c8f68ae",
"package_autoupdate": 0,
"package_build_version": " ",
"package_description": "Improve your writing with all-in-one assistance—including generative AI, grammar check, and more.",
"package_enabled": 1,
"package_from_webstore": 1,
"package_id": "kbfnbcaeplbcioakkpcpgfkobkghlhen",
"package_installed": "1717159065",
"package_name": "Grammarly: AI Writing Assistant and Grammar Checker App",
"package_path": "/home/nbertoldo/.config/google-chrome/Profile 1/Extensions/kbfnbcaeplbcioakkpcpgfkobkghlhen/14.1254.0_1",
"package_permissions": "scripting, sidePanel, tabs, notifications, cookies, identity, storage",
"package_persistent": 0,
"package_reference": "https://clients2.google.com/service/update2/crx",
"package_type": " ",
"package_version": "14.1254.0",
"package_visible": 0,
"scan_time": "2025/09/18 15:13:53",
"user_id": "1000"
},
"operation": "INSERTED",
"type": "dbsync_browser_extensions"
}
Generated when Windows updates are installed or removed (Windows only).
hotfix - Update identifier (e.g., KB5031356){
"data":
{
"checksum": "56162cd7bb632b4728ec868e8e271b01222ff131",
"hotfix": "KB12345678",
"scan_time": "2025/09/18 13:46:04"
},
"operation": "INSERTED",
"type": "dbsync_hotfixes"
}
| Category | Fields Prefix | Example Fields |
|---|---|---|
| Hardware | (direct fields) | board_serial, cpu_name, ram_total |
| Operating System | (direct fields) | hostname, os_name, os_version, architecture |
| Packages | (direct fields) | name, version, vendor |
| Network Interfaces | (direct fields) | name, state, mac |
| Network Addresses | (direct fields) | iface, address, proto |
| Network Protocols | (direct fields) | iface, gateway, type |
| Network Ports | (direct fields) | protocol, local_ip, local_port |
| Processes | (direct fields) | pid, name, cmd |
| Users | user_* | user_name, user_home, user_shell |
| Groups | group_* | group_name, group_description |
| Services | service_*, process_* | service_name, service_state |
| Browser Extensions | browser_*, package_* | browser_name, package_name |
| Hotfixes | (direct field) | hotfix |
All syscollector events include these standard fields:
scan_time - When the inventory scan occurredchecksum - MD5 hash for change detectionitem_id - Unique identifier for the inventory item (where applicable)Syscollector events are processed by the Inventory Harvester and stored directly in Wazuh Indexer without going through traditional rule processing, since they represent inventory state rather than security events.
Access syscollector inventory data through: