Parsers and Generated Fields
Tag Fields Created by Parser cisco-umbrella
#Cps.version
#Vendor
#ecs.version
#event.dataset
#event.kind
#event.module
#event.outcome
#observer.type
Fields Identified by Parser cisco-umbrella
| Source Field | CPS Field | Description | Mapping |
|---|---|---|---|
| Vendor.timestamp | @timestamp | Event timestamp in UTC | Parsed from Vendor.timestamp using parseTimestamp() with format detection |
| Vendor.internal_ip, Vendor.internal_client_ip, source.address | client.address | Client IP or hostname address | Copied from Vendor.internal_ip (dnslogs) or Vendor.internal_client_ip (proxylogs), converted to lowercase; copied from source.address (intrusionlogs) |
| client.address | client.domain | Client domain when address is not IP | Conditional assignment when client.address is not a valid IP |
| client.address | client.ip | Client IP when address is valid IP | Conditional assignment when client.address is valid IPv4/IPv6 |
| source.port | client.port | Client port number | Copied from source.port (intrusionlogs) |
| Vendor.aws_region | cloud.region | Cloud region name | Copied from Vendor.aws_region |
| Vendor.destination_ip, Vendor.external_ip | destination.address | Destination address | Copied from Vendor.destination_ip, converted to lowercase; overridden with Vendor.external_ip (dnslogs) |
| Vendor.destination, Vendor.fqdns | destination.domain | Destination domain name | Parsed from Vendor.destination using parseUri and converted to lowercase (dlplogs); copied from Vendor.fqdns converted to lowercase (firewalllogs) |
| destination.address | destination.ip | Destination IP when address is valid IP | Conditional assignment when destination.address is valid IPv4/IPv6 |
| Vendor.destination_port | destination.port | Destination port number | Copied from Vendor.destination_port when numeric |
| Vendor.domain | dns.question.name | DNS query domain name | Copied from Vendor.domain |
| Vendor.query_type | dns.question.type | DNS query type | Copied from Vendor.query_type |
| Vendor.response_code | dns.response_code | DNS response code | Copied from Vendor.response_code |
| None | ecs.version | ECS schema version | Static value: 9.4.0 |
| Vendor.certificate_errors | error.message | Certificate error message | Copied from Vendor.certificate_errors (proxylogs) |
| Vendor.action | event.action | Action taken by the system | Copied from Vendor.action, converted to lowercase |
| None | event.category[] | Event categorization array | Array populated based on log type: network (dns, proxy, firewall), network+web (proxy), configuration (audit), network+file (dlp), network+intrusion_detection (intrusion) |
| None | event.dataset | Dataset identifier for log type | Conditional assignment based on log type: umbrella.dns_traffic, umbrella.proxied_traffic, umbrella.admin_audit, umbrella.dlp_traffic, umbrella.ips_traffic, umbrella.firewall_traffic |
| Vendor.id, Vendor.unique_event_id | event.id | Unique event identifier | Copied from Vendor.id (auditlogs) or Vendor.unique_event_id (dlplogs) |
| None | event.kind | Event classification | Static value: event |
| None | event.module | Module name | Static value: umbrella |
| Vendor.amp_score | event.risk_score | Risk score from AMP | Copied from Vendor.amp_score |
| Vendor.severity | event.severity | Numeric event severity level | Mapped from Vendor.severity: CRITICAL=90, HIGH=70, MEDIUM=50, WARNING=50, LOW=30, VERY LOW=10 |
| Vendor.action | event.type[] | Event type classification | Array populated based on action and log type: protocol/connection/access + allowed/denied for dns/proxy/firewall/intrusion; creation/change/deletion for audit; access + allowed/denied for dlp |
| Vendor.sha256 | file.hash.sha256 | SHA256 hash of the file | Copied from Vendor.sha256, converted to lowercase (proxylogs, dlplogs) |
| Vendor.content_type | file.mime_type | File MIME type | Copied from Vendor.content_type (dlplogs) |
| Vendor.filename, Vendor.name | file.name | File name | Copied from Vendor.filename (proxylogs) or Vendor.name (dlplogs) |
| Vendor.owner | file.owner | File owner | Copied from Vendor.owner (dlplogs) |
| Vendor.file_size | file.size | File size in bytes | Copied from Vendor.file_size (dlplogs) |
| Vendor.request_size | http.request.bytes | HTTP request size in bytes | Copied from Vendor.request_size |
| Vendor.request_method | http.request.method | HTTP request method | Copied from Vendor.request_method |
| Vendor.content_type | http.request.mime_type | HTTP request content MIME type | Copied from Vendor.content_type |
| Vendor.referer | http.request.referrer | HTTP referrer header value | Copied from Vendor.referer |
| Vendor.response_body_size | http.response.body.bytes | HTTP response body size in bytes | Copied from Vendor.response_body_size |
| Vendor.response_size | http.response.bytes | HTTP response size in bytes | Copied from Vendor.response_size |
| Vendor.status_code | http.response.status_code | HTTP response status code | Copied from Vendor.status_code |
| Vendor.signature_message | message | Event message text | Copied from Vendor.signature_message (intrusionlogs) |
| Vendor.application_entity_name, Vendor.application | network.application | Network application name | Copied from Vendor.application_entity_name (proxylogs) or Vendor.application (dlplogs) |
| Vendor.packet_size | network.bytes | Network packet size in bytes | Copied from Vendor.packet_size (firewalllogs) |
| Vendor.direction, Vendor.traffic_direction | network.direction | Network traffic direction | Mapped from Vendor.direction: OUTBOUND=outbound, INBOUND=inbound, C2S=outbound, S2C=inbound, UNKNOWN=unknown; or from Vendor.traffic_direction (dlplogs) |
| Vendor.protocol | network.iana_number | IANA protocol number | Copied from Vendor.protocol (firewalllogs) |
| Vendor.ip_protocol | network.transport | Network transport protocol | Copied from Vendor.ip_protocol, converted to lowercase (intrusionlogs) |
| None | network.type | Network IP version type | Conditional assignment based on IP address validation: ipv4 or ipv6 |
| Vendor.origin_ids, Vendor.direction | observer.egress.interface.id | Egress observer interface ID | Copied from Vendor.origin_ids when Vendor.direction is OUTBOUND |
| Vendor.origin_ids, Vendor.direction | observer.ingress.interface.id | Ingress observer interface ID | Copied from Vendor.origin_ids when Vendor.direction is INBOUND |
| Vendor.organization_id | organization.id | Organization identifier | Copied from Vendor.organization_id |
| Vendor.attack_classification | rule.category | Rule attack category | Copied from Vendor.attack_classification (intrusionlogs) |
| Vendor.signature_method | rule.description | Rule description | Copied from Vendor.signature_method (intrusionlogs) |
| Vendor.rule_id, Vendor.signature_id, Vendor.firewall_rule_id | rule.id | Rule identifier | Copied from Vendor.rule_id (global); overridden with coalesce of Vendor.signature_id and Vendor.firewall_rule_id (intrusionlogs) |
| Vendor.rule | rule.name | Rule name | Copied from Vendor.rule (dlplogs) |
| Vendor.ruleset_id, Vendor.signature_list_id | rule.ruleset | Rule ruleset identifier | Copied from Vendor.ruleset_id (proxylogs) or Vendor.signature_list_id (intrusionlogs) |
| destination.address | server.address | Server address | Copied from destination.address (proxylogs, dnslogs, intrusionlogs) |
| server.address | server.domain | Server domain when address is not IP | Conditional assignment when server.address is not a valid IP |
| server.address | server.ip | Server IP when address is valid IP | Conditional assignment when server.address is valid IPv4/IPv6 |
| destination.port | server.port | Server port number | Copied from destination.port (intrusionlogs) |
| Vendor.source_ip, Vendor.internal_ip, Vendor.internal_client_ip, Vendor.external_client_ip, Vendor.logged_in_from | source.address | Source address | Copied from Vendor.source_ip (global), overridden per dataset: Vendor.internal_ip (dnslogs), coalesce of Vendor.internal_client_ip and Vendor.external_client_ip (proxylogs), Vendor.logged_in_from (auditlogs); all converted to lowercase |
| source.address | source.domain | Source domain when address is not IP | Conditional assignment when source.address is not a valid IP |
| Vendor.data_center | source.geo.name | Source geographic location name | Copied from Vendor.data_center (firewalllogs) |
| source.address | source.ip | Source IP when address is valid IP | Conditional assignment when source.address is valid IPv4/IPv6 |
| Vendor.egress_ip, Vendor.external_client_ip | source.nat.ip | Source NAT IP address | Copied from Vendor.egress_ip (global), overridden with Vendor.external_client_ip (proxylogs); dropped if not valid IP |
| Vendor.source_port | source.port | Source port number | Copied from Vendor.source_port |
| Vendor.amp_malware_name | threat.software.name | Threat malware name | Copied from Vendor.amp_malware_name (intrusionlogs) |
| Vendor.amp_malware_name | threat.software.type | Threat software type classification | Static value: Malware when Vendor.amp_malware_name exists |
| Vendor.destination | url.domain | URL domain extracted from destination | Parsed from Vendor.destination using parseUri, host field renamed and lowercased (dlplogs) |
| Vendor.url, Vendor.destination | url.original | Original full URL | Copied from Vendor.url (proxylogs) or Vendor.destination (dlplogs) |
| Vendor.identity, Vendor.email | user.email | User email address | Extracted from Vendor.identity using regex pattern (dlplogs) or copied from Vendor.email (auditlogs) |
| Vendor.identity | user.full_name | User full display name | Extracted from Vendor.identity using regex pattern (dlplogs) |
| Vendor.identity, Vendor.user | user.name | User account name | Extracted from Vendor.identity using regex pattern (dlplogs) or copied from Vendor.user (auditlogs) |
| Vendor.user-agent, Vendor.user_agent | user_agent.original | Original user agent string | Copied using coalesce of Vendor.user-agent and Vendor.user_agent |
| Vendor.cves | vulnerability.id | CVE vulnerability identifier | Copied from Vendor.cves (intrusionlogs) |