Parsers and Generated Fields

Tag Fields Created by Parser akamai-asec
  • #Cps.version

  • #Vendor

  • #ecs.version

  • #event.dataset

  • #event.kind

  • #event.module

  • #event.outcome

  • #observer.type

Fields Identified by Parser akamai-asec
Source FieldCPS FieldDescriptionMapping
Vendor.httpMessage.start@timestampEvent timestampParsed from Vendor.httpMessage.start using unixtime format
source.address (indirect)client.addressClient addressCopied from source.address
source.as.number (indirect)client.as.numberClient autonomous system numberCopied from source.as.number
source.geo.city_name (indirect)client.geo.city_nameClient city nameCopied from source.geo.city_name
source.geo.country_iso_code (indirect)client.geo.country_iso_codeClient country ISO codeCopied from source.geo.country_iso_code
source.geo.region_iso_code (indirect)client.geo.region_iso_codeClient region ISO codeCopied from source.geo.region_iso_code
source.ip (indirect)client.ipClient IP addressCopied from source.ip
Vendor.httpMessage.hostdestination.addressDestination addressCopied from host field and converted to lowercase
destination.address (indirect)destination.domainDestination domain nameCopied from destination.address
Vendor.httpMessage.portdestination.portDestination port numberCopied from Vendor.httpMessage.port
Noneecs.versionECS schema versionStatic value: 9.2.0
Vendor.attackData.ruleActions.decodedevent.actionWAF action takenCopied from decoded rule actions
Noneevent.category[]Event category arrayArray populated with network, web, intrusion_detection
Vendor.httpMessage.requestIdevent.idUnique event identifierCopied from Vendor.httpMessage.requestId
Noneevent.kindEvent kind classificationStatic value: event
Noneevent.moduleEvent module nameStatic value: asec
Noneevent.outcomeEvent outcome statusStatic value: success
event.action, http.response.status_codeevent.type[]Event type array with dynamic valuesArray populated with connection, access, and conditional values based on action and status
Vendor.httpMessage.requestHeaders.Content-Lengthhttp.request.bytesHTTP request size in bytesExtracted from parsed request headers
Vendor.httpMessage.requestIdhttp.request.idHTTP request identifierCopied from Vendor.httpMessage.requestId
Vendor.httpMessage.methodhttp.request.methodHTTP request methodCopied from Vendor.httpMessage.method
Vendor.httpMessage.requestHeaders.Content-Typehttp.request.mime_typeHTTP request content typeExtracted from parsed request headers
Vendor.httpMessage.requestHeaders.Refererhttp.request.referrerHTTP request referrerExtracted from parsed request headers
Vendor.httpMessage.byteshttp.response.bytesHTTP response size in bytesCopied from Vendor.httpMessage.bytes
Vendor.httpMessage.responseHeaders.Content-Typehttp.response.mime_typeHTTP response content typeExtracted from parsed response headers
Vendor.httpMessage.statushttp.response.status_codeHTTP response status codeCopied from Vendor.httpMessage.status
Vendor.httpMessage.protocolhttp.versionHTTP versionExtracted from protocol field or set to 2.0 for h2
Vendor.httpMessage.bytesnetwork.bytesNetwork bytes transferredCopied from Vendor.httpMessage.bytes
Vendor.httpMessage.protocolnetwork.protocolNetwork protocolExtracted from protocol field and converted to lowercase
source.address (indirect)network.typeNetwork address typeSet based on IP address type detection
Vendor.attackData.ruleTags.decodedrule.categorySecurity rule categoryCopied from decoded rule tags
Vendor.attackData.rules.decodedrule.idSecurity rule identifierCopied from decoded rules
Vendor.attackData.ruleMessages.decodedrule.nameSecurity rule nameCopied from decoded rule messages
Vendor.attackData.ruleVersions.decodedrule.versionSecurity rule versionCopied from decoded rule versions
destination.address (indirect)server.addressServer addressCopied from destination.address
destination.domain (indirect)server.domainServer domain nameCopied from destination.domain
destination.port (indirect)server.portServer port numberCopied from destination.port
Vendor.attackData.clientIPsource.addressSource IP addressCopied from client IP and converted to lowercase
Vendor.geo.asnsource.as.numberSource autonomous system numberCopied from Vendor.geo.asn
Vendor.geo.citysource.geo.city_nameSource city nameCopied from Vendor.geo.city
Vendor.geo.countrysource.geo.country_iso_codeSource country ISO codeCopied from Vendor.geo.country
source.geo.country_iso_code, Vendor.geo.regionCodesource.geo.region_iso_codeSource region ISO codeFormatted as country-region when both exist
source.address (indirect)source.ipSource IP addressSet based on IP address validation
Vendor.httpMessage.tlstls.versionTLS version numberExtracted from TLS field using regex pattern
Vendor.httpMessage.tlstls.version_protocolTLS protocol nameExtracted from TLS field using regex pattern
Vendor.httpMessage.hosturl.domainURL domain nameCopied from host field and converted to lowercase
Vendor.httpMessage.pathurl.pathURL path componentCopied from Vendor.httpMessage.path
Vendor.httpMessage.porturl.portURL port numberCopied from Vendor.httpMessage.port
Vendor.httpMessage.queryurl.queryURL query stringCopied from Vendor.httpMessage.query
Vendor.httpMessage.requestHeaders.User-Agentuser_agent.originalOriginal user agent stringExtracted from parsed request headers