Today, we updated our data model by removing certain metadata fields from all events. These changes are designed to enhance your experience in the following ways:

• Simplified Investigations: Focus more easily on critical signals by reducing metadata overhead.
• Stability in Detection Rules: Utilize immutable fields (UUIDs) to improve the reliability of detection rules and automations.
• Performance Boost: Enhance the performance of event searches and API calls.

In order to avoid disruption of your cyber-security operations, we automatically updated your detection rules that were impacted. Playbooks were also updated, but only for fields in the "Duplicate Fields" section.

If you are still using impacted fields ouside of Sekoia (in scripts, automations, etc.), you also have to update this logic yourself.

The change is effective on FRA1 (our main region) and will be rolled out to all regions in the coming days.

Description of Changes

Duplicate Fields

All events contained duplicated values for the UUIDs of the community, the entity, the intake, and the intake format. The fields using the sekoiaio. prefix are already available in events and should be used instead of the legacy fields.

The legacy fields listed in the table below are no longer available.

Legacy Field (deleted)	Prefixed Field (kept)
customer.community_uuid	sekoiaio.customer.community_uuid
customer.intake_uuid	sekoiaio.intake.uuid
entity.uuid	sekoiaio.entity.uuid
event.dialect_uuid	sekoiaio.intake.dialect_uuid
event.dialect	sekoiaio.intake.dialect

Deleted Fields

The following fields are no longer available in events. The matching UUID fields should be used instead when needed.

Deleted field name	UUID field to use
customer.community_name	sekoiaio.customer.community_uuid
sekoiaio.customer.community_name	sekoiaio.customer.community_uuid
customer.id	sekoiaio.customer.community_uuid
sekoiaio.customer.id	sekoiaio.customer.community_uuid
customer.intake_key	sekoiaio.intake.uuid
sekoiaio.intake.key	sekoiaio.intake.uuid
customer.intake_name	sekoiaio.intake.uuid
sekoiaio.intake.name	sekoiaio.intake.uuid
entity.id	sekoiaio.entity.uuid
sekoiaio.entity.id	sekoiaio.entity.uuid
entity.name	sekoiaio.entity.uuid
sekoiaio.entity.name	sekoiaio.entity.uuid

If you have any questions or need further assistance, please do not hesitate to contact our support team at support@sekoia.io.