1 duration continuous 2 protocol.type symbolic 3 service symbolic 4 flag symbolic 5 src.bytes continuous 6 dst.bytes continuous 7 land symbolic 8 wrong.fragment continuous 9 urgent continuous 10 hot continuous 11 num.failed.logins continuous 12 logged.in symbolic 13 num.compromised continuous 14 root.shell continuous 15 su.attempted continuous 16 num.root continuous 17 num.file.creations continuous 18 num.shells continuous 19 num.access.files continuous 20 num.outbound.cmds continuous 21 is.host.login symbolic 22 is.guest.login symbolic 23 count continuous 24 srv.count continuous 25 serror.rate continuous 26 srv.serror.rate continuous 27 rerror.rate continuous 28 srv.rerror.rate continuous 29 same.srv.rate continuous 30 diff.srv.rate continuous 31 srv.diff.host.rate continuous 32 dst.host.count continuous 33 dst.host.srv.count continuous 34 dst.host.same.srv.rate continuous 35 dst.host.diff.srv.rate continuous 36 dst.host.same.src.port.rate continuous 37 dst.host.srv.diff.host.rate continuous 38 dst.host.serror.rate continuous 39 dst.host.srv.serror.rate continuous 40 dst.host.rerror.rate continuous 41 dst.host.srv.rerror.rate continuous 42 connection.type symbolic