Parsers and Generated Fields
Tag Fields Created by Parser purestorage-flashblade
#Cps.version
#Vendor
#ecs.version
#event.dataset
#event.kind
#event.module
#event.outcome
#observer.type
Fields Identified by Parser purestorage-flashblade
| Source Field | CPS Field | Description | Mapping |
|---|---|---|---|
| Vendor.syslog.timestamp | @timestamp | Event timestamp extracted from syslog header | Parsed from syslog timestamp using MMM [ ]d HH:mm:ss format |
| None | ecs.version | ECS schema version | Static value: 9.4.0 |
| Vendor.ErrorMessage | error.message | Detailed error message from alert log | Copied from Vendor.ErrorMessage |
| Vendor.SuggestedAction, Vendor.Action, Vendor.Subcommand, Vendor.ACTION | event.action | Action taken or suggested | Copied from Vendor.SuggestedAction (alert), coalesce of Vendor.Action and Vendor.Subcommand (audit), or Vendor.ACTION (session) |
| log.logger, Vendor.Command, Vendor.Subcommand | event.category[] | Event categorization (host, process, session, authentication, threat, configuration) | Array populated based on log.logger and threat detection conditions |
| Vendor.FirstSeenArray, Vendor.Time, Vendor.UTC_Time, Vendor.time | event.created | Event creation time | Copied using coalesce from timestamp fields |
| Vendor.u_sid | event.hash | Lowercase SID used as event hash identifier | Parsed from Vendor.u_sid converted to lowercase |
| Vendor.AlertID, Vendor.GUID, Vendor.EventID, Vendor.eid | event.id | Unique event identifier | Copied using coalesce from various ID fields |
| Vendor.Command, Vendor.Subcommand, Vendor.Arguments | event.kind | Event classification; set to "alert" for critical administrative operations | Static value: event; overridden to "alert" for threat detections |
| None | event.module | Module identifier | Static value: flashblade |
| Vendor.result, Vendor.SUCCESS | event.outcome | Event outcome status | Mapped from Vendor.result or Vendor.SUCCESS to success/failure |
| Vendor.UI | event.provider | Interface used to perform the action (GUI or CLI) | Copied from Vendor.UI |
| Vendor.AlertMessage, Vendor.ErrorMessage | event.reason | Event reason description | Copied using coalesce from alert or error message fields |
| Vendor.Knowledgebase | event.reference | Reference URL for more information | Copied from Vendor.Knowledgebase |
| Vendor.AuditID | event.sequence | Event sequence number | Copied from Vendor.AuditID |
| Vendor.SeverityText, Vendor.Command, Vendor.Subcommand | event.severity | Numeric event severity level | Mapped from Vendor.SeverityText to numeric values (critical=90, high=70, medium=50, warning/low=30, info=10); overridden to 80/70/60 for threat detections |
| Vendor.FirstSeenUTC | event.start | Event start time in UTC | Copied from Vendor.FirstSeenUTC |
| log.logger, event.action | event.type[] | Event type classification (info, start, end, denied) | Array populated based on log.logger and event.action conditions |
| Vendor.fs | file.name | File system name from file audit event | Copied from Vendor.fs |
| Vendor.path | file.path | File path from file audit event | Copied from Vendor.path |
| Vendor.f_type | file.type | File type (e.g., dir) from file audit event | Copied from Vendor.f_type |
| Vendor.Host, log.syslog.hostname | host.hostname | Lowercase host identifier | Copied from Vendor.Host or log.syslog.hostname, converted to lowercase inline |
| @rawstring | log.logger | Logger/facility name (e.g., purity.audit, purity.alert) | Extracted from syslog header using regex pattern |
| @rawstring | log.syslog.hostname | Hostname from syslog header | Extracted from syslog header using regex pattern |
| @rawstring | log.syslog.priority | Syslog priority value | Extracted from syslog header using regex pattern |
| Vendor.Message | message | Original raw message content | Copied from Vendor.Message |
| Vendor.export_protocol, Vendor.fs_protocol | network.protocol | Network protocol associated with export or file system operation | Parsed from Vendor.export_protocol or Vendor.fs_protocol converted to lowercase |
| Vendor.Host | observer.hostname | Array hostname from alert log | Copied from Vendor.Host |
| Vendor.DeviceID | observer.serial_number | Array device serial number | Copied from Vendor.DeviceID |
| Vendor.PurityVersion | observer.version | Purity//FB software version | Copied from Vendor.PurityVersion |
| Vendor.Command, Vendor.Subcommand, Vendor.Arguments | process.command_line | Full command line string including command, subcommand, and arguments | Parsed from Vendor.Command, Vendor.Subcommand, and Vendor.Arguments formatted as "%s %s %s" |
| Vendor.Command | process.name | Name of the purity command executed | Copied from Vendor.Command |
| None | rule.category | MITRE ATT&CK tactic category (e.g., Defense Evasion, Data Destruction) | Static value assigned per threat detection rule |
| None | rule.description | Detailed description of the threat detection and its significance | Static value assigned per threat detection rule |
| None | rule.id | Unique rule identifier (e.g., PURE-FB-SYSLOG-CHANGE) | Static value assigned per threat detection rule |
| None | rule.name | Human-readable rule name describing the detection | Static value assigned per threat detection rule |
| Vendor.FROM | source.address | Source address (IP or hostname) | Copied from lowercase Vendor.FROM |
| source.address | source.domain | Source domain name | Copied from source.address when value is not a valid IP |
| Vendor.Location, Vendor.client_ip, source.address | source.ip | Source IP address | Copied from Vendor.Location, Vendor.client_ip, or source.address when value is a valid IP |
| Vendor.User, Vendor.USER | user.name | Authenticated username | Copied from Vendor.User or Vendor.USER |