Value,Description,Reference
asn,"Autonomous System Number (per the Address@category
        attribute).",[RFC7970]
atm,"Asynchronous Transfer Mode (ATM) address (per the
        Address@category attribute).",[RFC7970]
e-mail,Email address (per the Address@category attribute).,[RFC7970]
ipv4-addr,"IPv4 host address in dotted-decimal notation, e.g., 192.0.2.1 (per the Address@category attribute).",[RFC7970]
ipv4-net,"IPv4 network address in dotted-decimal notation,
        slash, significant bits, e.g., 192.0.2.0/24 (per the
        Address@category attribute).",[RFC7970]
ipv4-net-mask,"IPv4 network address in dotted-decimal
        notation, slash, network mask in dotted-decimal notation, i.e., 192.0.2.0/255.255.255.0 (per the Address@category
        attribute).",[RFC7970]
ipv6-addr,"IPv6 host address, e.g., 2001:DB8::3 (per the
        Address@category attribute).",[RFC7970]
ipv6-net,"IPv6 network address, slash, significant bits, e.g., 2001:DB8::/32 (per the Address@category attribute).",[RFC7970]
ipv6-net-mask,"IPv6 network address, slash, network mask
        (per the Address@category attribute).",[RFC7970]
mac,"Media Access Control (MAC) address, i.e., a:b:c:d:e:f (per the Address@category attribute).",[RFC7970]
site-uri,"A URL or URI for a resource (per the
        Address@category attribute).",[RFC7970]
domain-name,"A fully qualified domain name or part of a
        name (e.g., fqdn.example.com, example.com).",[RFC7970]
domain-to-ipv4,"A mapping of FQDN to IPv4 address specified as
        a comma-separated list (e.g., ""fqdn.example.com, 192.0.2.1"").",[RFC7970]
domain-to-ipv6,"A mapping of FQDN to IPv6 address specified as
        a comma separated list (e.g., ""fqdn.example.com,
        2001:DB8::3"").",[RFC7970]
domain-to-ipv4-timestamp,"Same as domain-to-ipv4 but with a
        timestamp (in the DATETIME format) of the resolution (e.g.,
        ""fqdn.example.com, 192.0.2.1, 2015-06-11T00:38:31-06:00"").",[RFC7970]
domain-to-ipv6-timestamp,"Same as domain-to-ipv6 but with a
        timestamp (in the DATETIME format) of the resolution (e.g.,
        ""fqdn.example.com, 2001:DB8::3, 2015-06-11T00:38:31-06:00"").",[RFC7970]
ipv4-port,"An IPv4 address, port, and protocol tuple (e.g.,
        192.0.2.1, 80, tcp).  The protocol name corresponds to the
        ""Keyword"" column in the [IANA registry protocol-numbers].",[RFC7970]
ipv6-port,"An IPv6 address, port, and protocol tuple (e.g.,
        2001:DB8::3, 80, tcp).  The protocol name corresponds to the
        ""Keyword"" column in the [IANA registry protocol-numbers].",[RFC7970]
windows-reg-key,A Microsoft Windows registry key.,[RFC7970]
file-hash,"A file hash.  The format of this hash is
        described in the Hash class that MUST be present in a sibling
        BulkObservableFormat class.",[RFC7970]
email-x-mailer,An X-Mailer field from an email.,[RFC7970]
email-subject,An email subject line.,[RFC7970]
http-user-agent,"A User Agent field from an HTTP request
        header (e.g., ""Mozilla/5.0 (Windows NT 6.3; WOW64; rv:38.0)
        Gecko/20100101 Firefox/38.0"").",[RFC7970]
http-request-uri,"The Request URI from an HTTP request
        header.",[RFC7970]
mutex,The name of a system mutex (mutual exclusion lock).,[RFC7970]
file-path,"A file path (e.g., ""/tmp/local/file"",
        ""c:\windows\system32\file.sys"").",[RFC7970]
user-name,A username.,[RFC7970]
ext-value,"A value used to indicate that this attribute is
        extended and the actual value is provided using the
        corresponding ext-* attribute.  See Section 5.1.1 of [RFC7970].",[RFC7970]