Parsers and Generated Fields
Tag Fields Created by Parser imperva-cwaf
#Cps.version
#Vendor
#ecs.version
#event.dataset
#event.kind
#event.module
#event.outcome
#observer.type
Fields Identified by Parser imperva-cwaf
| Vendor Field | CPS Field | Description |
|---|---|---|
| Vendor.sip | destination.ip | Destination IP address |
| Vendor.spt | destination.port | Destination port |
| Vendor.act | event.action | Action taken on the event |
| Vendor.end | event.end | Event end timestamp |
| Vendor.id | event.id | Event identifier |
| Vendor.name | event.kind, | If "Normal", sets event.kind="event", event.category[]="network", event.type[]="info"; otherwise sets event.kind="alert", event.category[]="threat", event.type[]="indicator" |
| http.response.status_code | event.outcome | Sets "success" for 2xx/3xx status codes, "failure" for 4xx/5xx status codes |
| Vendor.severity | event.risk_score | Numeric risk score from CEF severity |
| event.risk_score | event.severity | Maps risk scores to severity levels (0-3→30, 4-6→50, 7-8→70, 9-10→90) |
| host.risk.calculated_level | event.severity | Maps risk levels to severity (minor→30, major→50, critical→70) |
| Vendor.start | event.start | Event start timestamp |
| Vendor.severity | host.risk.calculated_level | Text-based risk level (MINOR, MAJOR, CRITICAL) |
| Vendor.requestMethod | http.request.method | HTTP request method |
| Vendor.ref | http.request.referrer | HTTP referrer URL |
| Vendor.cn1 | http.response.status_code | HTTP response status code |
| Vendor.src | source.address | Source address (could be IP or "Distributed") |
| Vendor.in | source.bytes | Number of bytes from source |
| Vendor.sourceServiceName | source.domain | Source domain name (converted to lowercase) |
| Vendor.cicode | source.geo.city_name | Source city name |
| Vendor.ccode | source.geo.country_iso_code | Source country code |
| Vendor.latitude | source.geo.location.lat | Source latitude |
| Vendor.longitude | source.geo.location.lon | Source longitude |
| source.address | source.ip | Source IP address (only if valid IP) |
| Vendor.cpt | source.port | Source port |
| Vendor.requestClientApplication | user_agent.original | User agent string |