Parsers and Generated Fields
Tag Fields Created by Parser microsoft-windows-dhcp-client
#Cps.version
#Vendor
#ecs.version
#event.dataset
#event.kind
#event.module
#event.outcome
#observer.type
Fields Identified by Parser microsoft-windows-dhcp-client
| Vendor Field | CPS Field | Description |
|---|---|---|
| `network.type` | Conditional | Vendor.ProviderName |
| `event.id` | Copied | Vendor.EventRecordId |
| `process.pid` | Copied | Vendor.ProcessID |
| `user.id` | Copied | Vendor.UserID |
| `ecs.version` | Static | None |
| `event.category[0]` | Static | None |
| `event.category[1]` | Static | None |
| `event.dataset` | Static | None |
| `event.kind` | Static | None |
| `event.module` | Static | None |
| `event.type[0]` | Static | None |
| `network.protocol` | Static | None |
| Vendor.EventRecordId | event.id | |
| Vendor.ProcessID | process.pid | |
| Vendor.UserID | user.id |
Tag Fields Created by Parser windows-dhcp-client
#Cps.version
#Vendor
#ecs.version
#event.dataset
#event.kind
#event.module
#event.outcome
#observer.type
Fields Identified by Parser windows-dhcp-client
| Vendor Field | CPS Field | Description |
|---|---|---|
| Vendor.EventRecordId | event.id | |
| Vendor.ProcessID | process.pid | |
| Vendor.UserID | user.id |