Parsers and Generated Fields
Tag Fields Created by Parser infoblox-nios
#Cps.version
#Vendor
#ecs.version
#event.dataset
#event.kind
#event.module
#event.outcome
#observer.type
Fields Identified by Parser infoblox-nios
| Source Field | CPS Field | Description | Mapping |
|---|---|---|---|
| log.syslog.timestamp | @timestamp | Event timestamp extracted from syslog header | Parsed from log.syslog.timestamp using parseTimestamp() |
| message, Vendor.audit.ip | client.address | Client address (IP or hostname) | Copied from Vendor.audit.ip for login events; extracted from message using regex for DHCP and DNS events |
| message, client.address | client.domain | Client domain name | Extracted from message using regex patterns, normalized with lower() |
| message, client.address | client.ip | Client IP address | Copied from client.address when it is an IPv4 or IPv6 address; extracted directly from r-l-e lease messages |
| message | client.mac | Client MAC address normalized to uppercase hyphen-separated format | Extracted from message using regex patterns, formatted with replace() and upper() |
| message | client.port | Client port number | Extracted from message using regex patterns |
| message | dns.answers[0].type | DNS RPZ answer type from CEF-formatted log | Extracted from CEF format DNS RPZ messages using regex |
| message | dns.answers[].class | DNS answer record class | Parsed from DNS response messages using JSON parsing of repeated answer records |
| message | dns.answers[].data | DNS answer record data | Parsed from DNS response messages using JSON parsing of repeated answer records |
| message | dns.answers[].name | DNS answer record name | Parsed from DNS response messages using JSON parsing of repeated answer records |
| message | dns.answers[].ttl | DNS answer record TTL | Parsed from DNS response messages using JSON parsing of repeated answer records |
| message | dns.answers[].type | DNS answer record type | Parsed from DNS response messages using JSON parsing of repeated answer records |
| message | dns.question.class | DNS question class | Extracted from DNS query and zone messages using regex patterns |
| message | dns.question.name | DNS question name | Extracted from DNS query, zone, transfer, and validation messages using regex patterns |
| message | dns.question.response_code | DNS response code | Extracted from DNS response messages using regex patterns |
| message | dns.question.type | DNS question type | Extracted from DNS query messages using regex patterns |
| message | dns.resolved_ip[] | Array of resolved IP addresses from DNS answers | Array populated from DNS response messages, filtered to retain only valid IP addresses using CIDR check |
| None | ecs.version | ECS schema version | Static value: 9.4.0 |
| message | event.action | Action associated with the event | Extracted from message using regex patterns, normalized with lower() |
| Vendor.service_name, event.action | event.category[] | Event category classification array | Array populated based on service type and action conditions |
| Vendor.service_name | event.dataset | Dataset identifier for the event | Static value based on matched service name: nios.audit, nios.dhcp, or nios.dns |
| None | event.kind | Kind of event | Static value: event |
| None | event.module | Module that produced the event | Static value: nios |
| event.action, message | event.outcome | Outcome of the event | Set based on event type and action conditions (success or failure) |
| Vendor.service_name, event.action | event.type[] | Event type classification array | Array populated based on service type and action conditions |
| @rawstring | host.domain | Hostname from syslog header | Extracted from syslog header using regex, normalized with lower() |
| host.domain | host.ip[] | Host IP address array | Array populated when host.domain is an IP address using CIDR check |
| message | host.name | Hostname from DHCP lease records | Extracted from r-l-e lease messages using regex |
| message | interface.name | Network interface name | Extracted from DHCP messages using regex patterns |
| @rawstring | log.syslog.priority | Syslog priority value | Extracted from syslog priority field using regex on @rawstring |
| @rawstring | log.syslog.timestamp | Raw syslog timestamp string | Extracted from syslog timestamp field using regex on @rawstring |
| @rawstring | message | Full log message content | Extracted from syslog message body using regex on @rawstring |
| message | network.name | Network name from DHCP boot request | Extracted from DHCP BOOTREQUEST messages using regex |
| message | network.transport | Network transport protocol | Extracted from DNS messages using regex patterns, normalized with lower() |
| client.address, server.address | network.type | Network IP version type | Set to ipv4 or ipv6 based on CIDR check of client.address or server.address |
| @rawstring | process.id | Process ID from syslog header | Extracted from syslog process bracket field using regex on @rawstring |
| message | server.address | Server address (IP or hostname) | Extracted from DNS and DHCP messages using regex patterns |
| server.address | server.domain | Server domain name | Copied from server.address when it is not an IP address |
| server.address | server.ip | Server IP address | Copied from server.address when it is an IPv4 or IPv6 address |
| message | server.mac | Server MAC address | Extracted from DHCP BOOTREPLY messages using regex patterns, formatted with replace() and upper() |
| message | server.port | Server port number | Extracted from DNS timeout resolution messages using regex patterns |
| Vendor.dhcp.trans_id | transaction.id | DHCP transaction ID | Copied from Vendor.dhcp.trans_id when value is numeric |
| message | user.name | Username from audit log events | Extracted from audit log messages using regex on bracketed username field, with replace() for space handling |