Parsers and Generated Fields

Tag Fields Created by Parser cisco-umbrella

  • #Cps.version

  • #Vendor

  • #ecs.version

  • #event.dataset

  • #event.kind

  • #event.module

  • #event.outcome

  • #observer.type

Fields Identified by Parser cisco-umbrella
Source FieldCPS FieldDescriptionMapping
Vendor.timestamp@timestampEvent timestamp in UTCParsed from Vendor.timestamp using parseTimestamp() with format detection
Vendor.internal_ip, Vendor.internal_client_ipclient.addressClient IP addressCopied from Vendor.internal_ip or Vendor.internal_client_ip, converted to lowercase
client.addressclient.domainClient domain when not IPConditional assignment when client.address is not valid IP
client.addressclient.ipClient IP when validConditional assignment when client.address is valid IPv4/IPv6
source.portclient.portClient port numberCopied from source.port
Vendor.aws_regioncloud.regionCloud regionCopied from Vendor.aws_region
Vendor.destination_ipdestination.addressDestination IP addressCopied from Vendor.destination_ip, converted to lowercase
Vendor.destination, Vendor.fqdnsdestination.domainDestination domain nameCopied from Vendor.destination or Vendor.fqdns, converted to lowercase
destination.addressdestination.ipDestination IP when validConditional assignment when destination.address is valid IPv4/IPv6
Vendor.destination_portdestination.portDestination port numberCopied from Vendor.destination_port when numeric
Vendor.domaindns.question.nameDNS query domainCopied from Vendor.domain
Vendor.query_typedns.question.typeDNS query typeCopied from Vendor.query_type
Vendor.response_codedns.response_codeDNS response codeCopied from Vendor.response_code
Noneecs.versionECS schema versionStatic value: 9.2.0
Vendor.certificate_errorserror.messageError messageCopied from Vendor.certificate_errors
Vendor.actionevent.actionAction taken by the systemCopied from Vendor.action, converted to lowercase
Noneevent.category[]Event categorization arrayArray populated based on log type
Noneevent.datasetDataset identifier for log typeConditional assignment based on log type
Vendor.id, Vendor.unique_event_idevent.idUnique event identifierCopied from Vendor.id or Vendor.unique_event_id
Noneevent.kindEvent classificationStatic value: event
Noneevent.moduleModule nameStatic value: umbrella
Vendor.amp_scoreevent.risk_scoreRisk scoreCopied from Vendor.amp_score
Vendor.severityevent.severityEvent severity levelMapped from Vendor.severity to numeric values
Vendor.actionevent.type[]Event type classificationArray populated based on action and log type
Vendor.sha256file.hash.sha256SHA256 hash of fileCopied from Vendor.sha256, converted to lowercase
Vendor.content_typefile.mime_typeFile MIME typeCopied from Vendor.content_type
Vendor.filename, Vendor.namefile.nameFile nameCopied from Vendor.filename or Vendor.name
Vendor.ownerfile.ownerFile ownerCopied from Vendor.owner
Vendor.file_sizefile.sizeFile size in bytesCopied from Vendor.file_size
Vendor.request_sizehttp.request.bytesHTTP request size in bytesCopied from Vendor.request_size
Vendor.request_methodhttp.request.methodHTTP request methodCopied from Vendor.request_method
Vendor.content_typehttp.request.mime_typeHTTP request content typeCopied from Vendor.content_type
Vendor.refererhttp.request.referrerHTTP referrer headerCopied from Vendor.referer
Vendor.response_body_sizehttp.response.body.bytesHTTP response body sizeCopied from Vendor.response_body_size
Vendor.response_sizehttp.response.bytesHTTP response size in bytesCopied from Vendor.response_size
Vendor.status_codehttp.response.status_codeHTTP response status codeCopied from Vendor.status_code
Vendor.signature_messagemessageEvent messageCopied from Vendor.signature_message
Vendor.application, Vendor.application_entity_namenetwork.applicationNetwork applicationCopied from Vendor.application or Vendor.application_entity_name
Vendor.packet_sizenetwork.bytesNetwork packet sizeCopied from Vendor.packet_size
Vendor.direction, Vendor.traffic_directionnetwork.directionNetwork traffic directionMapped from Vendor.direction or Vendor.traffic_direction
Vendor.protocolnetwork.iana_numberIANA protocol numberCopied from Vendor.protocol
Vendor.ip_protocolnetwork.transportNetwork transport protocolCopied from Vendor.ip_protocol, converted to lowercase
Nonenetwork.typeNetwork type (ipv4/ipv6)Conditional assignment based on IP address validation
Vendor.origin_idsobserver.egress.interface.idEgress interface IDCopied from Vendor.origin_ids when direction is outbound
Vendor.origin_idsobserver.ingress.interface.idIngress interface IDCopied from Vendor.origin_ids when direction is inbound
Vendor.organization_idorganization.idOrganization identifierCopied from Vendor.organization_id
Vendor.attack_classificationrule.categoryRule categoryCopied from Vendor.attack_classification
Vendor.signature_methodrule.descriptionRule descriptionCopied from Vendor.signature_method
Vendor.rule_id, Vendor.signature_id, Vendor.firewall_rule_idrule.idRule identifierCopied from Vendor.rule_id, Vendor.signature_id, or Vendor.firewall_rule_id using coalesce
Vendor.rulerule.nameRule nameCopied from Vendor.rule
Vendor.ruleset_id, Vendor.signature_list_idrule.rulesetRule rulesetCopied from Vendor.ruleset_id or Vendor.signature_list_id
destination.addressserver.addressServer IP addressCopied from destination.address
server.addressserver.domainServer domain when not IPConditional assignment when server.address is not valid IP
server.addressserver.ipServer IP when validConditional assignment when server.address is valid IPv4/IPv6
destination.portserver.portServer port numberCopied from destination.port
Vendor.source_ip, Vendor.internal_client_ip, Vendor.external_client_ipsource.addressSource IP addressCopied from Vendor.source_ip or Vendor.internal_client_ip, with fallback to Vendor.external_client_ip, converted to lowercase
source.addresssource.domainSource domain when not IPConditional assignment when source.address is not valid IP
Vendor.data_centersource.geo.nameSource geographic locationCopied from Vendor.data_center
source.addresssource.ipSource IP when validConditional assignment when source.address is valid IPv4/IPv6
Vendor.egress_ip, Vendor.external_client_ipsource.nat.ipSource NAT IP addressCopied from Vendor.egress_ip or Vendor.external_client_ip
Vendor.source_portsource.portSource port numberCopied from Vendor.source_port
Vendor.amp_malware_namethreat.software.nameThreat software nameCopied from Vendor.amp_malware_name
Vendor.amp_malware_namethreat.software.typeThreat software typeStatic value: Malware when amp_malware_name exists
Vendor.urlurl.originalOriginal URLCopied from Vendor.url
Vendor.identity, Vendor.emailuser.emailUser email addressExtracted from Vendor.identity using regex or copied from Vendor.email
Vendor.identityuser.full_nameUser full nameExtracted from Vendor.identity using regex
Vendor.identity, Vendor.useruser.nameUser nameExtracted from Vendor.identity using regex or copied from Vendor.user
Vendor.user_agentuser_agent.originalUser agent stringCopied from Vendor.user_agent using coalesce function
Vendor.cvesvulnerability.idCVE referenceCopied from Vendor.cves