Parsers and Generated Fields

Tag Fields Created by Parser imperva-cloudwaf

  • #Cps.version

  • #Vendor

  • #ecs.version

  • #event.dataset

  • #event.kind

  • #event.module

  • #event.outcome

  • #observer.type

Fields Identified by Parser imperva-cloudwaf
Source FieldCPS FieldDescriptionMapping
Vendor.start@timestampEvent timestampParsed from Vendor.start using millis format
Vendor.srcclient.addressClient addressCopied from Vendor.src with lowercase transformation
Vendor.inclient.bytesNumber of bytes from clientCopied from Vendor.in
Vendor.sourceServiceNameclient.domainClient domain nameParsed from Vendor.sourceServiceName with lowercase transformation
Vendor.cicodeclient.geo.city_nameClient city nameCopied from Vendor.cicode
Vendor.ccodeclient.geo.country_iso_codeClient country codeCopied from Vendor.ccode
Vendor.latitudeclient.geo.location.latClient latitudeCopied from Vendor.latitude
Vendor.longitudeclient.geo.location.lonClient longitudeCopied from Vendor.longitude
client.addressclient.ipClient IP addressConditional assignment from client.address when valid IP
Vendor.cptclient.portClient portCopied from Vendor.cpt
Vendor.sipdestination.addressDestination addressCopied from Vendor.sip with lowercase transformation
Vendor.dhostdestination.domainDestination domain nameCopied from Vendor.dhost with lowercase transformation
destination.addressdestination.ipDestination IP addressConditional assignment from destination.address when valid IP
Vendor.sptdestination.portDestination portCopied from Vendor.spt
Noneecs.versionECS schema versionStatic value: 9.2.0
Vendor.actevent.actionAction taken on the eventCopied from Vendor.act
Vendor.nameevent.category[]Event category classificationArray populated based on Vendor.name conditions
Vendor.endevent.endEvent end timestampCopied from Vendor.end
Vendor.idevent.idEvent identifierCopied from Vendor.id
Vendor.nameevent.kindEvent kind classificationConditional assignment based on Vendor.name
Noneevent.moduleEvent module identifierStatic value: cloudwaf
http.response.status_codeevent.outcomeEvent outcomeConditional assignment based on http.response.status_code
Vendor.severityevent.risk_scoreNumeric risk scoreCopied from Vendor.severity when numeric
event.risk_score, host.risk.calculated_levelevent.severityEvent severity levelMapped from event.risk_score or host.risk.calculated_level
Vendor.startevent.startEvent start timestampCopied from Vendor.start
Vendor.nameevent.type[]Event type classificationArray populated based on Vendor.name conditions
Vendor.severityhost.risk.calculated_levelText-based risk levelCopied from Vendor.severity when text
Vendor.requestMethodhttp.request.methodHTTP request methodCopied from Vendor.requestMethod
Vendor.refhttp.request.referrerHTTP referrer URLCopied from Vendor.ref
Vendor.cn1http.response.status_codeHTTP response status codeCopied from Vendor.cn1
Vendor.innetwork.bytesTotal bytes transferredCopied from Vendor.in
Vendor.xffnetwork.forwarded_ipForwarded IP addressCopied from Vendor.xff
Vendor.appnetwork.protocolNetwork protocolCopied from Vendor.app with lowercase transformation
source.address, client.address, destination.address, server.addressnetwork.typeNetwork type (ipv4/ipv6)Conditional assignment based on address CIDR validation
Vendor.device.productobserver.productObserver product nameCopied from Vendor.device.product
Vendor.device.vendorobserver.vendorObserver vendor nameCopied from Vendor.device.vendor
Vendor.device.versionobserver.versionObserver versionCopied from Vendor.device.version
Vendor.namerule.nameRule name that triggered the eventCopied from Vendor.name
Vendor.sipserver.addressServer addressCopied from Vendor.sip with lowercase transformation
server.addressserver.domainServer domain nameConditional assignment from server.address when not valid IP
server.addressserver.ipServer IP addressConditional assignment from server.address when valid IP
Vendor.sptserver.portServer portCopied from Vendor.spt
Vendor.srcsource.addressSource addressCopied from Vendor.src with lowercase transformation
Vendor.insource.bytesNumber of bytes from sourceCopied from Vendor.in
Vendor.sourceServiceNamesource.domainSource domain nameParsed from Vendor.sourceServiceName with lowercase transformation
Vendor.cicodesource.geo.city_nameSource city nameCopied from Vendor.cicode
Vendor.ccodesource.geo.country_iso_codeSource country codeCopied from Vendor.ccode
source.geo.country_iso_codesource.geo.country_nameSource country nameMapped from source.geo.country_iso_code using country lookup
Vendor.latitudesource.geo.location.latSource latitudeCopied from Vendor.latitude
Vendor.longitudesource.geo.location.lonSource longitudeCopied from Vendor.longitude
source.geo.country_iso_codesource.geo.region_iso_codeSource region ISO codeMapped from source.geo.country_iso_code using region lookup
source.geo.country_iso_codesource.geo.region_nameSource region nameMapped from source.geo.country_iso_code using region lookup
source.addresssource.ipSource IP addressConditional assignment from source.address when valid IP
Vendor.cptsource.portSource portCopied from Vendor.cpt
Vendor.requesturl.originalOriginal URLCopied from Vendor.request
Vendor.qstrurl.queryURL query stringCopied from Vendor.qstr
Vendor.requestClientApplicationuser_agent.originalUser agent stringCopied from Vendor.requestClientApplication