Parsers and Generated Fields

Tag Fields Created by Parser aws-waf

  • #Cps.version

  • #Vendor

  • #ecs.version

  • #event.dataset

  • #event.kind

  • #event.module

  • #event.outcome

  • #observer.type

Fields Identified by Parser aws-waf
Source FieldCPS FieldDescriptionMapping
Vendor.timestamp@timestampEvent timestampParsed from Vendor.timestamp using milliseconds format
Vendor.webaclIdcloud.account.idAWS account IDExtracted from Vendor.webaclId using regex pattern
Vendor.webaclIdcloud.regionAWS regionExtracted from Vendor.webaclId using regex pattern for regional WebACLs
Vendor.httpSourceNamecloud.service.nameAWS service nameStatic value based on Vendor.httpSourceName match (apigateway, cloudfront, elbv2)
Noneecs.versionECS schema versionStatic value: 9.2.0
Vendor.actionevent.actionAction taken by WAFCopied from Vendor.action and converted to lowercase
Noneevent.category[]Event categorizationArray populated with ["web"]
Noneevent.kindEvent kind classificationStatic value: event
Noneevent.moduleModule identifierStatic value: waf
event.actionevent.outcomeEvent outcomeStatic value based on event.action match (success for allow, failure for block)
Noneevent.type[]Event type classificationArray populated with ["access"]
Vendor.httpRequest.requestIdhttp.request.idUnique request identifierCopied from Vendor.httpRequest.requestId
Vendor.httpRequest.httpMethodhttp.request.methodHTTP method usedCopied from Vendor.httpRequest.httpMethod
Vendor.httpRequest.headers[]http.request.referrerHTTP referrerExtracted from referer header
Vendor.httpRequest.httpVersionhttp.versionHTTP versionExtracted from Vendor.httpRequest.httpVersion using regex pattern
Vendor.httpRequest.httpVersionnetwork.protocolNetwork protocolExtracted from Vendor.httpRequest.httpVersion using regex pattern and converted to lowercase
network.protocolnetwork.transportNetwork transport protocolStatic value: tcp (when network.protocol is http)
Vendor.terminatingRuleTyperule.categoryWAF rule categoryCopied from Vendor.terminatingRuleType
Vendor.terminatingRuleIdrule.idWAF rule identifierCopied from Vendor.terminatingRuleId
Vendor.webaclIdrule.nameWebACL rule nameExtracted from Vendor.webaclId using regex pattern
Vendor.webaclIdrule.rulesetWAF WebACL ARNCopied from Vendor.webaclId
Vendor.httpRequest.headers[], Vendor.httpRequest.clientIpsource.addressSource address with X-Forwarded-For priorityExtracted from X-Forwarded-For header or copied from Vendor.httpRequest.clientIp
source.addresssource.domainSource domain nameCopied from source.address when not a valid IP
Vendor.httpRequest.countrysource.geo.country_iso_codeCountry code of client IPCopied from Vendor.httpRequest.country
source.addresssource.ipSource IP addressCopied from source.address when valid IP
Vendor.httpRequest.clientIpsource.nat.ipNAT IP addressCopied from Vendor.httpRequest.clientIp when X-Forwarded-For is present
Vendor.ja3Fingerprinttls.client.ja3JA3 TLS fingerprintCopied from Vendor.ja3Fingerprint
Vendor.httpRequest.headers[]url.domainURL domainExtracted from Host header
Vendor.httpRequest.uriurl.pathRequest URI pathCopied from Vendor.httpRequest.uri
Vendor.httpRequest.headers[]url.portURL portExtracted from Host header when port is present
Vendor.httpRequest.argsurl.queryURL query parametersCopied from Vendor.httpRequest.args
Vendor.httpRequest.schemeurl.schemeURL schemeCopied from Vendor.httpRequest.scheme
Vendor.httpRequest.headers[]user_agent.originalOriginal user agent stringExtracted from User-Agent header