Parsers and Generated Fields
Tag Fields Created by Parser purestorage-flasharray
#Cps.version
#Vendor
#ecs.version
#event.dataset
#event.kind
#event.module
#event.outcome
#observer.type
Fields Identified by Parser purestorage-flasharray
| Source Field | CPS Field | Description | Mapping |
|---|---|---|---|
| Vendor.syslog.timestamp | @timestamp | Event timestamp extracted from the BSD syslog header | Parsed from syslog timestamp using MMM [ ]d HH:mm:ss format |
| None | ecs.version | ECS schema version used for field normalization | Static value: 9.4.0 |
| Vendor.Code | error.code | Numeric error or alert message code | Copied from Vendor.Code |
| Vendor.ErrorMessage | error.message | Human-readable error or alert summary message | Copied from Vendor.ErrorMessage |
| Vendor.Action | event.action | The action performed as recorded in the audit log | Copied from Vendor.Action |
| log.logger, event.action, Vendor.Command, Vendor.Action, Vendor.SubCommand | event.category[] | Event category classification | Array populated based on log.logger and event.action conditions; "threat" and/or "configuration" appended for threat detections |
| Vendor.UTCTime | event.created | UTC timestamp when the event was created on the array | Copied from Vendor.UTCTime |
| Vendor.Command, Vendor.Action, Vendor.SubCommand | event.kind | Classification of the event as a standard event or a threat alert | Static value: event; conditionally overridden to "alert" for threat detections |
| None | event.module | Identifies the module that produced the event | Static value: flasharray |
| Vendor.ErrorMessage, Vendor.AlertID | event.reason | Human-readable reason or alert ID associated with the event | Coalesced from error.message or Vendor.AlertID |
| Vendor.SeverityText, Vendor.Command, Vendor.Action | event.severity | Numeric severity level of the event | Mapped from Vendor.SeverityText using severity levels; overridden by static values (70-90) for threat detections |
| event.action, Vendor.Command, Vendor.Action, Vendor.SubCommand | event.type[] | Event type classification | Array populated based on event.action conditions; "indicator" and/or "change" appended for threat detections |
| log.syslog.hostname | host.hostname | Lowercase hostname of the system that generated the log | Parsed from log.syslog.hostname with lowercase conversion |
| @rawstring | log.logger | Logger name identifying the log source (e.g., purity.audit, space_utility_json.py) | Extracted from syslog message using regex pattern |
| @rawstring | log.syslog.hostname | Hostname field from the syslog header | Extracted from syslog message using regex pattern |
| @rawstring | log.syslog.priority | Syslog priority value from the message header | Extracted from syslog message using regex pattern |
| @rawstring | log.syslog.procid | Process ID from the syslog header | Extracted from syslog message using regex pattern |
| Vendor.Host, Vendor.ArrayName | observer.hostname | Hostname of the FlashArray that generated the event | Coalesced from Vendor.Host or Vendor.ArrayName |
| Vendor.Command, Vendor.Action | rule.category | Category of the triggered threat detection rule | Static value assigned per detection rule (e.g., Data Destruction, Defense Evasion) |
| Vendor.Command, Vendor.Action | rule.description | Detailed description of the threat detection rule and its significance | Static value assigned per detection rule describing the threat context |
| Vendor.Command, Vendor.Action | rule.id | Unique identifier for the triggered threat detection rule | Static value assigned per detection rule (e.g., PURE-FA-VOL-ERADICATE) |
| Vendor.Command, Vendor.Action | rule.name | Human-readable name of the triggered threat detection rule | Static value assigned per detection rule (e.g., FlashArray volume eradicated) |
| Vendor.User | user.name | Username associated with the audit event | Copied from Vendor.User |