Parsers and Generated Fields

Tag Fields Created by Parser darktrace-detect

  • #Cps.version

  • #Vendor

  • #ecs.version

  • #event.dataset

  • #event.kind

  • #event.module

  • #event.outcome

  • #observer.type

Fields Identified by Parser darktrace-detect
Source FieldCPS FieldDescriptionMapping
ts, Vendor.createdAt, Vendor.time, Vendor.last_updated, Vendor.ms_ts, Vendor.start@timestampEvent timestampParsed from timestamp fields based on event type
Vendor.dstdestination.addressDestination addressCopied from vendor field
Vendor.macdestination.macDestination MAC addressCopied from vendor field
Noneecs.versionECS schema versionStatic value: 9.1.0
Vendor.attachment_sha1s[]email.attachments[].file.hash.sha1Email attachment SHA1 hashesParsed from JSON transformation of vendor field
Vendor.attachment_sha256s[]email.attachments[].file.hash.sha256Email attachment SHA256 hashesParsed from JSON transformation of vendor field
Vendor.directionemail.directionEmail directionCopied from vendor field
Vendor.fromemail.from.address[]Email sender addressesArray populated with lowercase transformation
Vendor.message_idemail.message_idEmail message identifierExtracted using regex from vendor field
Vendor.subjectemail.subjectEmail subjectCopied from vendor field
Vendor.recipients[]email.to.address[]Email recipient addressesArray populated using objectArray from vendor field
Vendor.type, Vendor.modelevent.actionEvent actionCopied from vendor fields
event.datasetevent.category[]Event categorizationArray populated based on event.dataset conditions
Vendor.codeidevent.codeEvent codeCopied from vendor field
Vendor.creationTimeevent.createdEvent creation timeCopied from vendor field
Vendor.summariser, Vendor.model.name, Vendor.alert_name, Vendor.ms_ts, Vendor.iris-event-type, Vendor.device.product, Vendor.directionevent.datasetDataset classificationExtracted based on message content patterns
Vendor.periods[0].end, Vendor.endevent.endEvent end timeCopied from vendor fields
Vendor.id, Vendor.uuid, Vendor.codeuuidevent.idEvent identifierCopied from vendor fields
Vendor.category, Vendor.statusevent.kindEvent kind classificationStatic value: event, conditionally set to alert
Noneevent.moduleEvent module identifierStatic value: detect
Vendor.reason, http.response.status_code, Vendor.inhibitorevent.outcomeEvent outcomeMapped from event conditions
Vendor.title, Vendor.description, Vendor.message, Vendor.reason, Vendor.nameevent.reasonEvent reason or descriptionCopied from vendor fields
Vendor.aiaScore, Vendor.score, Vendor.anomaly_score, Vendor.priorityevent.risk_scoreEvent risk scoreCopied from vendor fields
Vendor.aiaScore, Vendor.score, Vendor.model.priority, Vendor.priority, Vendor.severityevent.severityEvent severity levelMapped based on score thresholds and conditions
Vendor.periods[0].start, Vendor.startevent.startEvent start timeCopied from vendor fields
event.dataset, Vendor.inhibitor, Vendor.reasonevent.type[]Event type classificationArray populated based on event.dataset and conditions
Vendor.incidentEventUrl, Vendor.breachUrl, Vendor.url, Vendor.darktraceUrlevent.urlEvent URLCopied from vendor fields
Vendor.currentGroupgroup.idGroup identifierCopied from vendor field
Vendor.device.hostname, Vendor.hostnamehost.hostnameHost hostnameCopied from vendor fields or derived from IP
Vendor.device.didhost.idHost device identifierCopied from vendor field
Vendor.device.ip, Vendor.device.ip6, Vendor.ip_address, Vendor.hostname, Vendor.dvchost.ip[]Host IP addressesArray populated from vendor fields with CIDR validation
Vendor.device.macaddress, Vendor.deviceMacAddress, host.machost.mac[0]Host MAC addressTransformed from vendor field (colon to dash, uppercase)
Vendor.dvchosthost.nameHost nameCopied from vendor field
Vendor.device.oshost.os.typeHost operating system typeTransformed to lowercase from vendor field
Vendor.device.typenamehost.typeHost device typeCopied from vendor field
Vendor.methodhttp.request.methodHTTP request methodCopied from vendor field
Vendor.statushttp.response.status_codeHTTP response status codeCopied from vendor field
@rawstringlog.syslog.appnameSyslog application nameExtracted from syslog header
@rawstringlog.syslog.hostnameSyslog hostnameExtracted from syslog header
@rawstringlog.syslog.prioritySyslog priorityExtracted from syslog header
Vendor.namemessageMessage contentCopied from vendor field
Noneobserver.typeObserver typeStatic value: ndr, conditionally email-scanning
Vendor.pdidprocess.pidProcess identifierCopied from vendor field
Vendor.model.created.byrule.author[]Rule authorArray populated from vendor field
Vendor.model.category, Vendor.action_familyrule.categoryRule categoryCopied from vendor fields
Vendor.model.description, Vendor.inhibitorrule.descriptionRule descriptionCopied from vendor fields
Vendor.model.name, Vendor.modelrule.nameRule nameCopied from vendor fields
Vendor.model.uuidrule.uuidRule UUIDCopied from vendor field
Vendor.model.versionrule.versionRule versionCopied from vendor field
Vendor.sourceIP, Vendor.ipsource.ipSource IP addressCopied from vendor fields with CIDR validation
Vendor.activityId, Vendor.currentGroupthreat.group.idThreat group identifierCopied from vendor fields
Vendor.mitreTactics[]threat.tactic.name[]MITRE ATT&CK tactic namesArray populated using objectArray from vendor field
Vendor.mitreTechniques[].techniqueID, Vendor.mitreIdthreat.technique.id[]MITRE ATT&CK technique IDsArray populated using objectArray from vendor fields
Vendor.mitreTechniques[].techniquethreat.technique.name[]MITRE ATT&CK technique namesArray populated using objectArray from vendor field
Vendor.usernameuser.nameUsernameCopied from vendor field