Parsers and Generated Fields
Tag Fields Created by Parser darktrace-detect
#Cps.version
#Vendor
#ecs.version
#event.dataset
#event.kind
#event.module
#event.outcome
#observer.type
Fields Identified by Parser darktrace-detect
| Source Field | CPS Field |
|---|---|
| Vendor.model | event.action |
| Vendor.codeid | event.code |
| Vendor.creationTime | event.created |
| Vendor.end | event.end |
| Vendor.periods[0].end | event.end |
| Vendor.codeuuid | event.id |
| Vendor.id | event.id |
| Vendor.uuid | event.id |
| Vendor.message | event.reason |
| Vendor.reason | event.reason |
| Vendor.title | event.reason |
| Vendor.aiaScore | event.risk_score |
| Vendor.priority | event.risk_score |
| Vendor.score | event.risk_score |
| Vendor.model.priority | event.severity |
| Vendor.periods[0].start | event.start |
| Vendor.start | event.start |
| Vendor.breachUrl | event.url |
| Vendor.incidentEventUrl | event.url |
| Vendor.url | event.url |
| Vendor.device.hostname | host.hostname |
| Vendor.hostname | host.hostname |
| Vendor.device.did | host.id |
| Vendor.device.hostname | host.ip[0] |
| Vendor.device.ip | host.ip[0] |
| Vendor.hostname | host.ip[0] |
| Vendor.ip_address | host.ip[0] |
| Vendor.device.ip6 | host.ip[1] |
| Vendor.device.typename | host.type |
| Vendor.pdid | process.pid |
| Vendor.model.created.by | rule.author |
| Vendor.action_family | rule.category |
| Vendor.model.category | rule.category |
| Vendor.inhibitor | rule.description |
| Vendor.model.description | rule.description |
| Vendor.model | rule.name |
| Vendor.model.name | rule.name |
| Vendor.model.uuid | rule.uuid |
| Vendor.model.version | rule.version |
| Vendor.activityId | threat.group.id |
| Vendor.mitreTactics[0].tacticID | threat.tactic.id[0] |
| Vendor.mitreTactics[1].tacticID | threat.tactic.id[1] |
| Vendor.mitreTactics[1].techniqueID | threat.tactic.id[1] |
| Vendor.mitreTactics[0].tactic | threat.tactic.name[0] |
| Vendor.mitreTactics[1].tactic | threat.tactic.name[1] |
| Vendor.mitreTactics[1].tacticID | threat.tactic.name[1] |
| Vendor.mitreTechniques[0].techniqueID | threat.technique.id[0] |
| Vendor.mitreTechniques[1].techniqueID | threat.technique.id[1] |
| Vendor.mitreTechniques[0].technique | threat.technique.name[0] |
| Vendor.mitreTechniques[1].technique | threat.technique.name[1] |
| Vendor.username | user.name |