[sse_json_doc_storage]
enforceTypes = true
replicate = false
field._time = time
field.version = string
field.description = string
field.json = string
field.compression = bool

[data_inventory_products]
enforceTypes = false
replicate = false
field.created_time = time
field.updated_time = time
field.productId = string
field.productName = string
field.vendorName = string
field.eventtypeId = string
field.status = string
field.stage = string
field.basesearch = string
field.metadata_json = string
field.cim_detail = string
field.eventsize = number
field.cim_compliant_fields = number
field.daily_event_volume = number
field.daily_host_volume = number
field.desired_sampling_ratio = number
field.termsearch = string
field.coverage_level = number
field.jsonStatus = string


[data_inventory_eventtypes]
enforceTypes = false
replicate = false
field.name = string
field.datasource = string
field.created_time = time
field.updated_time = time
field.eventtypeId = string
field.productId = string
field.status = string
field.basesearch = string
field.search_result = string
field.search_status = string
field.coverage_level = number

[data_source_check_outputs]
enforceTypes = true
replicate = false
field._time = time
field.elementId = string
field.elementName = string
field.status = string


[sse_content_exported]
enforceTypes = true
replicate = true
field.search_title = string
field.mitre_id = string
field.mitre_display = string
field.mitre_description = string
field.mitre_technique_combined = string
field.mitre_technique = string
field.mitre_tactic_combined = string
field.mitre_tactic = string
field.mitre_tactic_display = string
field.mitre_sub_technique_combined = string
field.mitre_sub_technique = string
field.killchain = string
field.showcaseId = string
field.showcaseName = string
field.category = string
field.mitre_technique_description = string
field.mitre_tactic_description = string
field.mitre_sub_technique_description = string
field.analytic_story = string


[data_source_check]
enforceTypes = true
replicate = false
field._time = time
field.showcaseId = string
field.showcaseName = string
field.searchId = string
field.searchName = string
field.status = string

[bookmark]
enforceTypes = true
replicate = false
field._time = time
field.showcase_name = string
field.status = string
field.user = string
field.notes = string

[bookmark_names]
field.description = string
field.name = string
field.referenceName = string

[external_content]
enforceTypes = true
replicate = false
field.first_checked = time
field.last_checked = time
field.last_updated = time
field.channel = string
field.build = string

[bookmark_custom]
enforceTypes = true
replicate = false
field._time = time
field.showcase_name = string
field.status = string
field.datasource = string
field.description = string
field.journey = string
field.user = string

[custom_content]
enforceTypes = true
replicate = false
field._time = time
field.showcaseId = string
field.channel = string
field.json = string
field.local_json = string
field.user = string

[local_search_mappings]
enforceTypes = true
replicate = false
field._time = time
field.showcaseId = string
field.search_title = string
field.user = string

[deleted_custom_content]
enforceTypes = true
replicate = false
field._time = time
field.showcaseId = string
field.channel = string
field.json = string
field.user = string

[sse_app_config]
enforceTypes = true
replicate = false
field._time = time
field.param = string
field.value = string
field.user = string

[ransomware_content_browser]
field.description = string
field.email = string
field.id = string
field.location = string
field.phase = string
field.timestamp = string
field.title = string
field.type = string

[mitre_custom_threat_groups]
field.mitre_threat_groups = string
field.mitre_threat_group_value = string

[mitre_custom_technique_lists]
field.List = string
field.Techniques = string
field.Reference = string