{
  "$schema" : "https://json-schema.org/draft/2020-12/schema",
  "type" : "object",
  "properties" : {
    "timestamp" : {
      "type" : "string",
      "format" : "date-time",
      "x-isAttributed" : false,
      "description" : "The timestamp when the event originally occurred"
    },
    "job" : {
      "type" : "string",
      "x-isAttributed" : false,
      "description" : "Name of the job"
    },
    "hostname" : {
      "type" : "string",
      "x-isAttributed" : false,
      "format" : "hostname",
      "description" : "Hostname of the asset"
    },
    "status" : {
      "type" : "string",
      "enum" : [ "job.status.queued", "job.status.completed", "job.status.started", "job.status.error", "job.status.failed", "job.status.stopped", "job.status.terminated", "job.status.sigint", "job.status.sigterm", "job.status.sigabrt", "job.status.sigalrm", "job.status.metrics", "job.status.warning" ],
      "x-isAttributed" : false,
      "description" : "The status of the running job"
    },
    "message" : {
      "type" : "string",
      "x-isAttributed" : false,
      "description" : "The message associated with the job status"
    },
    "invocation_id" : {
      "type" : "string",
      "x-isAttributed" : false,
      "description" : "The unique ID of the job invocation"
    },
    "events_reported" : {
      "type" : "string",
      "x-isAttributed" : false,
      "description" : "The number of messages the job sent",
      "pattern" : "\\d+"
    },
    "queued_time" : {
      "type" : "string",
      "format" : "date-time",
      "x-isAttributed" : false,
      "description" : "The time the job was queued"
    },
    "started_time" : {
      "type" : "string",
      "format" : "date-time",
      "x-isAttributed" : false,
      "description" : "The time the job started"
    },
    "finished_time" : {
      "type" : "string",
      "format" : "date-time",
      "x-isAttributed" : false,
      "description" : "The time the job finished"
    },
    "r7_hostid" : {
      "type" : "string",
      "x-isAttributed" : true,
      "description" : "Unique identifier of the host running the job"
    },
    "source_json" : {
      "type" : "object",
      "x-isAttributed" : false,
      "description" : "The data that was received or collected by our collector or endpoint agent, formatted as JSON"
    },
    "source_data" : {
      "type" : "string",
      "x-isAttributed" : false,
      "description" : "The unparsed, original log line as received from the collector"
    },
    "custom_data" : {
      "type" : "object",
      "x-isAttributed" : false,
      "description" : "JSON string produced by applying one or more user-defined custom parsers to the original data"
    },
    "r7_context" : {
      "type" : "object",
      "properties" : {
        "asset" : {
          "type" : "object",
          "properties" : {
            "name" : {
              "type" : "string",
              "x-isAttributed" : false,
              "description" : "The name of the r7context resource"
            },
            "rrn" : {
              "type" : "string",
              "x-isAttributed" : false,
              "description" : "The RRN (Rapid7 Resource Name) of the r7context resource",
              "pattern" : "rrn(_[^\\s:]+)?:[^\\s:]+:[^\\s:]*:[^\\s:]*(:[^\\s:]+)+"
            },
            "type" : {
              "type" : "string",
              "x-isAttributed" : false,
              "description" : "The type of r7context field",
              "const" : "asset"
            }
          },
          "required" : [ "name", "rrn", "type" ],
          "x-isAttributed" : true
        }
      },
      "x-isAttributed" : true,
      "description" : "R7_context includes attributed information related to the entry, with references to Rapid7-specific RRNs"
    },
    "entry_id" : {
      "type" : "string",
      "x-isAttributed" : false,
      "description" : "Unique Entry ID assigned to each document or log entry"
    }
  },
  "required" : [ "timestamp", "job", "hostname", "status", "invocation_id", "r7_hostid" ],
  "description" : "Status of a job sent from an endpoint agent to an endpoint event source"
}