Parsers and Generated Fields
Tag Fields Created by Parser imperva-cloudwaf
#Cps.version
#Vendor
#ecs.version
#event.dataset
#event.kind
#event.module
#event.outcome
#observer.type
Fields Identified by Parser imperva-cloudwaf
| Vendor Field | CPS Field | Description |
|---|---|---|
| `event.category[]` | Array | Vendor.name |
| `event.type[]` | Array | Vendor.name |
| `client.ip` | Conditional | client.address |
| `destination.ip` | Conditional | destination.address |
| `event.kind` | Conditional | Vendor.name |
| `event.outcome` | Conditional | http.response.status_code |
| `network.type` | Conditional | source.address, client.address, destination.address, server.address |
| `server.domain` | Conditional | server.address |
| `server.ip` | Conditional | server.address |
| `source.ip` | Conditional | source.address |
| `client.address` | Copied | Vendor.src |
| `client.bytes` | Copied | Vendor.in |
| `client.geo.city_name` | Copied | Vendor.cicode |
| `client.geo.country_iso_code` | Copied | Vendor.ccode |
| `client.geo.location.lat` | Copied | Vendor.latitude |
| `client.geo.location.lon` | Copied | Vendor.longitude |
| `client.port` | Copied | Vendor.cpt |
| `destination.address` | Copied | Vendor.sip |
| `destination.domain` | Copied | Vendor.dhost |
| `destination.port` | Copied | Vendor.spt |
| `event.action` | Copied | Vendor.act |
| `event.end` | Copied | Vendor.end |
| `event.id` | Copied | Vendor.id |
| `event.risk_score` | Copied | Vendor.severity |
| `event.start` | Copied | Vendor.start |
| `host.risk.calculated_level` | Copied | Vendor.severity |
| `http.request.method` | Copied | Vendor.requestMethod |
| `http.request.referrer` | Copied | Vendor.ref |
| `http.response.status_code` | Copied | Vendor.cn1 |
| `network.bytes` | Copied | Vendor.in |
| `network.forwarded_ip` | Copied | Vendor.xff |
| `network.protocol` | Copied | Vendor.app |
| `observer.product` | Copied | Vendor.device.product |
| `observer.vendor` | Copied | Vendor.device.vendor |
| `observer.version` | Copied | Vendor.device.version |
| `rule.name` | Copied | Vendor.name |
| `server.address` | Copied | Vendor.sip |
| `server.port` | Copied | Vendor.spt |
| `source.address` | Copied | Vendor.src |
| `source.bytes` | Copied | Vendor.in |
| `source.geo.city_name` | Copied | Vendor.cicode |
| `source.geo.country_iso_code` | Copied | Vendor.ccode |
| `source.geo.location.lat` | Copied | Vendor.latitude |
| `source.geo.location.lon` | Copied | Vendor.longitude |
| `source.port` | Copied | Vendor.cpt |
| `url.original` | Copied | Vendor.request |
| `url.query` | Copied | Vendor.qstr |
| `user_agent.original` | Copied | Vendor.requestClientApplication |
| `event.severity` | Mapped | event.risk_score, host.risk.calculated_level |
| `source.geo.country_name` | Mapped | source.geo.country_iso_code |
| `source.geo.region_iso_code` | Mapped | source.geo.country_iso_code |
| `source.geo.region_name` | Mapped | source.geo.country_iso_code |
| `@timestamp` | Parsed | Vendor.start |
| `client.domain` | Parsed | Vendor.sourceServiceName |
| `source.domain` | Parsed | Vendor.sourceServiceName |
| `ecs.version` | Static | None |
| `event.module` | Static | None |
| Vendor.in | client.bytes | |
| Vendor.cicode | client.geo.city_name | |
| Vendor.ccode | client.geo.country_iso_code | |
| Vendor.latitude | client.geo.location.lat | |
| Vendor.longitude | client.geo.location.lon | |
| client.address | client.ip | |
| Vendor.cpt | client.port | |
| destination.address | destination.ip | |
| Vendor.spt | destination.port | |
| Vendor.act | event.action | |
| Vendor.end | event.end | |
| Vendor.id | event.id | |
| Vendor.start | event.start | |
| Vendor.requestMethod | http.request.method | |
| Vendor.ref | http.request.referrer | |
| Vendor.cn1 | http.response.status_code | |
| Vendor.in | network.bytes | |
| Vendor.xff | network.forwarded_ip | |
| Vendor.device.product | observer.product | |
| Vendor.device.vendor | observer.vendor | |
| Vendor.device.version | observer.version | |
| Vendor.name | rule.name | |
| server.address | server.ip | |
| Vendor.spt | server.port | |
| Vendor.in | source.bytes | |
| Vendor.cicode | source.geo.city_name | |
| Vendor.ccode | source.geo.country_iso_code | |
| Vendor.latitude | source.geo.location.lat | |
| Vendor.longitude | source.geo.location.lon | |
| source.address | source.ip | |
| Vendor.cpt | source.port | |
| Vendor.request | url.original | |
| Vendor.qstr | url.query | |
| Vendor.requestClientApplication | user_agent.original |