Parsers and Generated Fields

Tag Fields Created by Parser cisco-firepower

  • #Cps.version

  • #Vendor

  • #ecs.version

  • #event.dataset

  • #event.kind

  • #event.module

  • #event.outcome

  • #observer.type

Fields Identified by Parser cisco-firepower
Source FieldCPS FieldDescriptionMapping
@rawstring@timestampEvent timestampExtracted from syslog timestamp using findTimestamp()
source.address, destination.addressclient.addressClient addressConditionally mapped from source.address or destination.address based on event context
source.bytes, destination.bytesclient.bytesClient byte countConditionally mapped from source.bytes or destination.bytes based on event context
source.ip, destination.ipclient.ipClient IP addressConditionally mapped from source.ip or destination.ip based on event context
Vendor.messageclient.nat.ipClient NAT IP addressExtracted from message using regex patterns
source.port, destination.portclient.portClient port numberConditionally mapped from source.port or destination.port based on event context
Vendor.message, Vendor.DstIPdestination.addressDestination addressExtracted from message using regex or from Vendor.DstIP, then lowercased
Vendor.ResponderBytesdestination.bytesDestination byte countCopied from Vendor.ResponderBytes
destination.addressdestination.domainDestination domainDerived from destination.address when not a valid IP
destination.addressdestination.ipDestination IP addressDerived from destination.address when valid IP (CIDR check)
Vendor.NAT_ResponderIPdestination.nat.ipNAT destination IPExtracted from Vendor.NAT_ResponderIP using regex
Vendor.NAT_ResponderPortdestination.nat.portNAT destination portCopied from Vendor.NAT_ResponderPort
Vendor.ResponderPacketsdestination.packetsDestination packet countCopied from Vendor.ResponderPackets
Vendor.message, Vendor.DstPortdestination.portDestination port numberExtracted from message using regex or copied from Vendor.DstPort
Vendor.messagedestination.user.domainDestination user domain (ICMP events)Extracted from ICMP connection message using regex pattern
Vendor.messagedestination.user.nameDestination username (ICMP events)Extracted from ICMP connection message using regex pattern
Vendor.DeviceUUIDdevice.idDevice UUID identifierCopied from Vendor.DeviceUUID
Vendor.messagedns.answers[0].dataDNS answer dataExtracted from message using regex patterns
Vendor.DNS_TTLdns.answers[0].ttlDNS answer TTLCopied from Vendor.DNS_TTL
Vendor.DNSQuery, Vendor.messagedns.question.nameDNS query nameCopied from Vendor.DNSQuery or extracted from message
Vendor.DNSRecordTypedns.question.typeDNS record typeNormalized from Vendor.DNSRecordType (A, AAAA, PTR, MX, CNAME)
Vendor.DNSResponseTypedns.response_codeDNS response codeCopied from Vendor.DNSResponseType
Noneecs.versionECS schema versionStatic value: 9.5.0
event.reason (indirect via Vendor.message)error.messageError message contentCopied from event.reason for SVC error events (722001-06) and IKEv2 failure events (751001-05)
Vendor.AccessControlRuleAction, Vendor.messageevent.actionAction takenCopied from Vendor.AccessControlRuleAction or extracted from message using regex
Vendor.mnemonicevent.category[]Event category classificationArray populated based on event code conditions
Vendor.mnemonicevent.codeEvent code identifier assigned before the match blockCopied from Vendor.mnemonic
Noneevent.datasetDataset identifierStatic value: firepower.log
Noneevent.kindEvent categorizationStatic value: event
Noneevent.moduleModule nameStatic value: firepower
Vendor.mnemonic, Vendor.teardown_reasonevent.outcomeEvent outcome statusConditional assignment based on event context and teardown reason
Vendor.AccessControlRuleReason, Vendor.messageevent.reasonReason for actionCopied from Vendor.AccessControlRuleReason or extracted from message using regex
Vendor.EventPriorityevent.severityEvent severity levelMapped from Vendor.EventPriority (high=70, medium=50, low=30)
Vendor.FirstPacketSecondevent.startEvent start timeCopied from Vendor.FirstPacketSecond
Vendor.mnemonicevent.type[]Event type classificationArray populated based on event code conditions
Vendor.messagefile.directoryFile directory pathExtracted from message using regex for FTP events (303002)
Vendor.ArchiveSHA256, Vendor.FileSHA256file.hash.sha256File SHA256 hashCoalesced and lowercased from Vendor.ArchiveSHA256 and Vendor.FileSHA256
Vendor.ArchiveFileName, Vendor.FileNamefile.nameFile nameCoalesced from Vendor.ArchiveFileName and Vendor.FileName
Vendor.message (indirect via Vendor.Group)group.nameVPN group nameExtracted from Vendor.Group for event codes 716038, 716039
Vendor.InstanceIDhost.idHost instance identifierCopied from Vendor.InstanceID
Vendor.message (indirect via Vendor.host)host.ip[]Host IP address arrayConditionally populated from Vendor.host when valid IP (CIDR check) for event codes 605004, 605005
Vendor.HTTPRefererhttp.request.referrerHTTP referrer headerCopied from Vendor.HTTPReferer
Vendor.HTTPResponsehttp.response.status_codeHTTP response status codeCopied from Vendor.HTTPResponse
@rawstringlog.syslog.appnameSyslog application nameExtracted from syslog header using regex
@rawstringlog.syslog.hostnameSyslog source hostnameExtracted from syslog header using regex
@rawstringlog.syslog.prioritySyslog priority valueExtracted from syslog header using regex
@rawstringlog.syslog.procidSyslog process IDExtracted from syslog header using regex
Vendor.message_identifierlog.syslog.severity.codeSyslog severity codeExtracted from Vendor.message_identifier via regex
log.syslog.severity.codelog.syslog.severity.nameSyslog severity nameMapped from log.syslog.severity.code (1=Alert, 2=Critical, 3=Error, 4=Warning, 5=Notification, 6=Informational, 7=Debugging)
Vendor.messagemessageNormalized log message contentCopied from Vendor.message
Vendor.WebApplicationnetwork.applicationNetwork application nameCopied from Vendor.WebApplication
source.bytes, destination.bytesnetwork.bytesTotal network bytesCalculated from source.bytes + destination.bytes
Vendor.messagenetwork.directionNetwork direction (inbound/outbound)Extracted from message and lowercased for connection events
Vendor.messagenetwork.iana_numberIANA protocol numberExtracted from message when protocol is numeric
destination.packets, source.packetsnetwork.packetsTotal network packetsCalculated from destination.packets + source.packets
network.protocol, Vendor.ApplicationProtocolnetwork.protocolNetwork protocolCoalesced and lowercased from network.protocol and Vendor.ApplicationProtocol
network.transport, Vendor.Protocol, network.iana_numbernetwork.transportTransport protocolCoalesced and lowercased from network.transport and Vendor.Protocol; also mapped from network.iana_number
Vendor.EgressInterface, observer.egress.interface.nameobserver.egress.interface.aliasEgress interface aliasCoalesced from Vendor.EgressInterface and observer.egress.interface.name
Vendor.messageobserver.egress.interface.nameEgress interface nameExtracted from message for event codes 106015, 605004, 605005
Vendor.EgressVRFobserver.egress.vlan.nameEgress VRF nameCopied from Vendor.EgressVRF
Vendor.message, Vendor.EgressZoneobserver.egress.zoneEgress zoneExtracted from message or copied from Vendor.EgressZone
log.syslog.hostnameobserver.hostnameObserver hostnameCopied from log.syslog.hostname
Vendor.IngressInterface, observer.ingress.interface.nameobserver.ingress.interface.aliasIngress interface aliasCoalesced from Vendor.IngressInterface and observer.ingress.interface.name
Vendor.IngressVRFobserver.ingress.vlan.nameIngress VRF nameCopied from Vendor.IngressVRF
Vendor.message, Vendor.IngressZoneobserver.ingress.zoneIngress zoneExtracted from message or copied from Vendor.IngressZone
Noneobserver.typeObserver typeStatic value: firewall
Vendor.messageprocess.command_lineExecuted command lineExtracted from message for event code 111010
Vendor.message (indirect)related.ip[]Related IP addresses arrayPopulated from Vendor.real_address_ip1 and Vendor.real_address_ip2 for TCP/UDP teardown events (302014, 302016)
Vendor.DetectionTyperule.categoryRule detection categoryCopied from Vendor.DetectionType
Vendor.AccessControlRuleReasonrule.descriptionRule description/reasonCopied from Vendor.AccessControlRuleReason
Vendor.AccessControlRuleNamerule.nameAccess control rule nameCopied from Vendor.AccessControlRuleName
Vendor.ACPolicyrule.rulesetAccess control policy nameCopied from Vendor.ACPolicy
destination.address, source.addressserver.addressServer addressConditionally mapped from destination.address or source.address based on event context
destination.bytes, source.bytesserver.bytesServer byte countConditionally mapped from destination.bytes or source.bytes based on event context
Vendor.messageserver.ipServer IP for AAA authentication eventsExtracted from message for events 113015-17
destination.port, source.portserver.portServer port numberConditionally mapped from destination.port or source.port based on event context
Vendor.message, Vendor.SrcIPsource.addressSource addressExtracted from message using regex or from Vendor.SrcIP, then lowercased
Vendor.InitiatorBytessource.bytesSource byte countCopied from Vendor.InitiatorBytes
source.addresssource.domainSource domainDerived from source.address when not a valid IP
source.addresssource.ipSource IP addressDerived from source.address when valid IP (CIDR check)
Vendor.messagesource.macSource MAC addressExtracted from message and formatted with hyphen separators
Vendor.NAT_InitiatorIPsource.nat.ipNAT source IPExtracted from Vendor.NAT_InitiatorIP using regex
Vendor.NAT_InitiatorPortsource.nat.portNAT source portCopied from Vendor.NAT_InitiatorPort
Vendor.InitiatorPacketssource.packetsSource packet countCopied from Vendor.InitiatorPackets
Vendor.message, Vendor.SrcPortsource.portSource port numberExtracted from message using regex or copied from Vendor.SrcPort
Vendor.messagesource.user.nameSource username for authentication eventsExtracted from message using regex patterns for VPN/auth events (113015-17, 716038-39, 611101-02, 605004-05, 113012-13, 113006, 113039, 109011, 109034, 113021, 750003, 751001-05)
Vendor.SSLCipherSuitetls.cipherTLS cipher suiteConditionally copied from Vendor.SSLCipherSuite when not "Unknown"
Vendor.SSLCertificatetls.client.hash.sha1TLS certificate SHA1 hashCopied from Vendor.SSLCertificate and lowercased
Vendor.SSLServerNametls.client.server_nameTLS server nameCopied from Vendor.SSLServerName
Vendor.SSLVersiontls.versionTLS versionConditionally copied from Vendor.SSLVersion when not "Unknown"
url.originalurl.domainURL domainParsed from url.original using parseUrl() and lowercased
url.originalurl.fullFull URLCopied from url.original
Vendor.URLurl.originalOriginal URLCopied from Vendor.URL
url.originalurl.pathURL pathParsed from url.original using parseUrl()
url.originalurl.schemeURL schemeParsed from url.original using parseUrl()
Vendor.messageuser.domainUser domainExtracted from message using regex patterns and lowercased
user.nameuser.emailUser email addressDerived from user.name when it contains @ symbol, then lowercased
Vendor.messageuser.group.nameUser group nameExtracted from message using regex patterns
Vendor.Useruser.idUser identifierCopied from Vendor.User when not "No Authentication Required"
Vendor.messageuser.nameUsernameExtracted from message using regex patterns and lowercased
Vendor.Clientuser_agent.nameClient application nameCopied from Vendor.Client
Vendor.UserAgentuser_agent.originalOriginal user agent stringCopied from Vendor.UserAgent
Vendor.ClientVersionuser_agent.versionClient versionCopied from Vendor.ClientVersion