Parsers and Generated Fields

Tag Fields Created by Parser f5networks-bigip

  • #Cps.version

  • #Vendor

  • #ecs.version

  • #event.dataset

  • #event.kind

  • #event.module

  • #event.outcome

  • #observer.type

Fields Identified by Parser f5networks-bigip
Source FieldCPS FieldDescriptionMapping
Vendor.timestamp, _ts@timestampEvent timestampParsed from timestamp fields using various formats
Vendor.ip_clientclient.addressClient address for ASM eventsCopied from Vendor.ip_client
Vendor.messageclient.domainClient hostnameExtracted from regex patterns
Vendor.client_ip_geo_locationclient.geo.country_iso_codeClient geographic locationCopied from Vendor.client_ip_geo_location
Vendor.client_ip, client.addressclient.ipClient IP addressCopied from various vendor fields
Vendor.client_portclient.portClient port numberCopied from Vendor.client_port
Vendor.dest_ip, Vendor.dest_fqdndestination.addressDestination addressCopied from various vendor fields
Vendor.bytes_outdestination.bytesDestination bytes transferredCopied from Vendor.bytes_out
Vendor.dest_ip, destination.addressdestination.ipDestination IP addressCopied from various vendor fields
Vendor.translated_dest_ipdestination.nat.ipTranslated destination IPCopied from Vendor.translated_dest_ip
Vendor.translated_dest_portdestination.nat.portTranslated destination portCopied from Vendor.translated_dest_port
Vendor.dest_portdestination.portDestination port numberCopied from Vendor.dest_port
Vendor.device_iddevice.idDevice identifierCopied from Vendor.device_id
Vendor.device_vendordevice.manufacturerDevice manufacturerCopied from Vendor.device_vendor
Vendor.answerdns.answers[]DNS response answersParsed from Vendor.answer using JSON formatting
Vendor.question_classdns.question.classDNS question classCopied from Vendor.question_class
Vendor.question_namedns.question.nameDNS question nameCopied from Vendor.question_name
Vendor.wideipdns.question.registered_domainDNS registered domainCopied from Vendor.wideip
Vendor.question_typedns.question.typeDNS question typeCopied from Vendor.question_type
Noneecs.versionECS schema versionStatic value: 9.2.0
Vendor.messageerror.codeError codeExtracted from regex patterns
Vendor.messageerror.messageError messageExtracted from regex patterns
log.syslog.msgid, Vendor.messageevent.actionEvent actionStatic values based on log type and message ID
log.syslog.appname, log.syslog.msgidevent.category[]Event categoriesArray populated based on log type
log.syslog.appname, log.syslog.msgidevent.datasetEvent datasetStatic values based on log source
Vendor.req_elapsed_timeevent.durationEvent duration in microsecondsCalculated from Vendor.req_elapsed_time * 1000000
Vendor.support_idevent.idEvent identifierCopied from Vendor.support_id
Vendor.attack_typeevent.kindEvent kindStatic value: event (conditional: alert for ASM threats)
Noneevent.moduleEvent moduleStatic value: bigip
Vendor.action, Vendor.status, etc.event.outcomeEvent outcomeConditional based on various vendor fields
Vendor.drop_reason, Vendor.anomaliesevent.reasonEvent reasonCopied from various vendor fields
Vendor.severityevent.severityEvent severity levelMapped from Vendor.severity values
log.syslog.msgid, Vendor.messageevent.type[]Event typesArray populated based on event context
file.pathfile.nameFile nameExtracted from file.path using regex
Vendor.messagefile.pathFile pathExtracted from regex patterns
Vendor.messagegeo.continent_codeGeographic continent codeExtracted from regex patterns
Vendor.messagegeo.country_iso_codeGeographic country codeExtracted from regex patterns
Vendor.messagegeo.region_nameGeographic region nameExtracted from regex patterns
Vendor.hostnamehost.hostnameHost hostnameCopied from Vendor.hostname (lowercased)
Vendor.hosthost.ip[]Host IP addressesArray populated from Vendor.host
Vendor.hostname, log.syslog.hostnamehost.nameHost nameCopied from coalesced vendor fields
Vendor.bytes_inhttp.request.body.bytesHTTP request body sizeCopied from Vendor.bytes_in
Vendor.reqhttp.request.body.contentHTTP request contentCopied from Vendor.req
Vendor.method, Vendor.http_methodhttp.request.methodHTTP request methodCopied from Vendor.method
Vendor.http_content_typehttp.request.mime_typeHTTP request MIME typeCopied from Vendor.http_content_type
Vendor.messagehttp.request.referrerHTTP request referrerExtracted from regex patterns
Vendor.bytes_outhttp.response.body.bytesHTTP response body sizeCopied from Vendor.bytes_out
Vendor.resphttp.response.body.contentHTTP response contentCopied from Vendor.resp
Vendor.resp_code, Vendor.HTTP statushttp.response.status_codeHTTP response status codeCopied from Vendor.resp_code
Vendor.req, Vendor.http_versionhttp.versionHTTP versionExtracted from regex patterns
log.syslog.severity.name, Vendor.severitylog.levelLog levelCopied from log.syslog.severity.name (lowercased)
@rawstringlog.syslog.appnameSyslog application nameExtracted from syslog parsing
log.syslog.prioritylog.syslog.facility.codeSyslog facility codeCalculated from log.syslog.priority / 8
@rawstringlog.syslog.hostnameSyslog hostnameExtracted from syslog parsing
@rawstringlog.syslog.msgidSyslog message IDExtracted from syslog parsing
@rawstringlog.syslog.prioritySyslog priorityExtracted from syslog parsing
@rawstringlog.syslog.procidSyslog process IDExtracted from syslog parsing
@rawstringlog.syslog.severity.codeSyslog severity codeExtracted from syslog parsing
@rawstringlog.syslog.severity.nameSyslog severity nameExtracted from syslog parsing
Vendor.bytes_in, Vendor.bytes_outnetwork.bytesTotal network bytesCalculated from Vendor.bytes_in + Vendor.bytes_out
Vendor.x_fwd_hdr_valnetwork.forwarded_ipForwarded IP addressCopied from Vendor.x_fwd_hdr_val
Vendor.ip_protocol, Vendor.http_protocol_indicationnetwork.protocolNetwork protocolCopied from Vendor.ip_protocol (lowercased)
Vendor.messagenetwork.transportNetwork transport protocolCopied from Vendor.message (lowercased)
client.address, destination.address, etc.network.typeNetwork type (ipv4/ipv6)Conditional based on IP address validation
Vendor.dest_vlannetwork.vlan.idVLAN IDCopied from Vendor.dest_vlan
Vendor.vlannetwork.vlan.nameVLAN nameCopied from Vendor.vlan
Vendor.messageobserver.egress.vlan.idObserver egress VLAN IDExtracted from regex patterns
Vendor.hostnameobserver.hostnameObserver hostnameCopied from Vendor.hostname
Vendor.messageobserver.ingress.vlan.idObserver ingress VLAN IDExtracted from regex patterns
Vendor.context_nameobserver.ingress.zoneObserver ingress zoneCopied from Vendor.context_name
Vendor.bigip_mgmt_ip, Vendor.manage_ip_addrobserver.ip[]Observer IP addressesArray populated from various vendor fields
Vendor.device_productobserver.productObserver productCopied from Vendor.device_product
Noneobserver.vendorObserver vendorStatic value: F5
Vendor.device_versionobserver.versionObserver versionCopied from Vendor.device_version
Vendor.messageprocess.command_lineProcess command lineExtracted from regex patterns
Vendor.messageprocess.nameProcess nameExtracted from regex patterns
Vendor.pidprocess.pidProcess IDCopied from Vendor.pid
Vendor.acl_policy_namerule.categoryRule categoryCopied from Vendor.acl_policy_name
Vendor.acl_rule_uuidrule.idRule identifierCopied from Vendor.acl_rule_uuid
Vendor.violations, Vendor.acl_rule_namerule.nameRule namesCopied from Vendor.violations
Vendor.enforced_by, Vendor.acl_policy_typerule.rulesetRule rulesetCopied from Vendor.enforced_by
Vendor.node, server.ipserver.addressServer addressCopied from various vendor fields
Vendor.messageserver.domainServer domainExtracted from regex patterns (lowercased)
server.addressserver.ipServer IP addressCopied from server.address when valid IP
Vendor.message, Vendor.node_portserver.portServer portExtracted from regex patterns
Vendor.source_fqdn, Vendor.src_ipsource.addressSource addressCopied from various vendor fields
Vendor.bytes_insource.bytesSource bytes transferredCopied from Vendor.bytes_in
Vendor.src_geo, Vendor.geo_infosource.geo.country_iso_codeSource geographic locationCopied from various vendor fields
Vendor.source_ip, source.addresssource.ipSource IP addressCopied from various vendor fields
Vendor.translated_source_ipsource.nat.ipTranslated source IPCopied from Vendor.translated_source_ip
Vendor.translated_source_portsource.nat.portTranslated source portCopied from Vendor.translated_source_port
Vendor.source_port, Vendor.src_portsource.portSource port numberCopied from Vendor.source_port
Vendor.source_user_groupsource.user.group.nameSource user groupCopied from Vendor.source_user_group
Vendor.source_usersource.user.nameSource usernameCopied from Vendor.source_user
Nonethreat.frameworkThreat frameworkStatic value: F5
Vendor.threat_campaign_namesthreat.group.alias[]Threat group aliasesArray from Vendor.threat_campaign_names split by comma
Vendor.attack_typethreat.technique.name[]Threat technique namesArray from Vendor.attack_type split by comma
Vendor.sig_idsthreat.technique.subtechnique.id[]Threat subtechnique IDsArray from Vendor.sig_ids split by comma
Vendor.sig_namesthreat.technique.subtechnique.name[]Threat subtechnique namesArray from Vendor.sig_names split by comma
Vendor.messagetls.cipherTLS cipher suiteExtracted from regex patterns
Vendor.messagetls.versionTLS versionExtracted from regex patterns
Vendor.messagetls.version_protocolTLS protocol versionExtracted from regex patterns
Vendor.http_hosturl.domainURL domainExtracted from Vendor.http_host (lowercased)
Vendor.http_url, Vendor.HTTP URIurl.originalOriginal URLCopied from Vendor.http_url
Vendor.http_uri, Vendor.client_request_uriurl.pathURL pathCopied from Vendor.http_uri
Vendor.http_hosturl.portURL portExtracted from Vendor.http_host
Vendor.http_referrerurl.schemeURL schemeExtracted from Vendor.http_referrer
Vendor.messageuser.emailUser emailExtracted from regex patterns
Vendor.username, user.name, Vendor.useruser.nameUsernameCopied from various vendor fields
Vendor.messageuser.roles[]User rolesArray populated from regex patterns
user_agent.originaluser_agent.nameUser agent nameExtracted from user_agent.original
Vendor.http_user_agent, user_agent.originaluser_agent.originalUser agent stringCopied from various vendor fields
user_agent.originaluser_agent.versionUser agent versionExtracted from user_agent.original