Parsers and Generated Fields
Tag Fields Created by Parser netgate-pfsense
#Cps.version
#Vendor
#ecs.version
#event.dataset
#event.kind
#event.module
#event.outcome
#observer.type
Fields Identified by Parser netgate-pfsense
| Source Field | CPS Field | Description | Mapping |
|---|---|---|---|
| Vendor.timestamp | @timestamp | Event timestamp extracted from syslog header | Parsed from syslog timestamp using parseTimestamp function |
| client.ip, client.domain | client.address | DHCP client network address | Coalesced from client.ip and client.domain |
| Vendor.hostname | client.domain | DHCP client domain name | Transformed from Vendor.hostname using lowercase |
| __temp.for_ip, __temp.on_ip, __temp.from_to | client.ip | DHCP client IP address | Extracted from DHCP message fields |
| __temp.from_to | client.mac | DHCP client MAC address | Extracted from DHCP message with formatting |
| destination.ip, destination.domain | destination.address | Destination network address | Coalesced from destination.ip and destination.domain |
| client.domain, destination.ip, Vendor.host | destination.domain | Destination domain name | Copied from client.domain or transformed from IP/host |
| Vendor.dst_ip, Vendor.host | destination.ip | Destination IP address | Copied from Vendor.dst_ip or Vendor.host with IP validation |
| client.mac | destination.mac | Destination MAC address | Copied from client.mac with formatting |
| Vendor.dst_port | destination.port | Destination port number | Copied from Vendor.dst_port |
| None | ecs.version | ECS schema version identifier | Static value: "9.2.0" |
| Vendor.action, event.action | event.action | Action taken by the system | Copied from vendor action or transformed based on log type |
| log.syslog.appname | event.category[] | Event category classification array | Array populated based on log type: ["network"], ["authentication"], ["network", "configuration"] |
| log.syslog.appname | event.dataset | Dataset identifier for log categorization | Static value based on log type: "pfsense.filterlog", "pfsense.dhcp", "pfsense.charon", "pfsense.login", "pfsense.filterdns" |
| None | event.kind | Event categorization type | Static value: "event" |
| None | event.module | Module name identifier | Static value: "pfsense" |
| Vendor.action | event.outcome | Event outcome status | Conditional value based on action: "success", "failure", "unknown" |
| Vendor.reason | event.reason | Reason for the firewall action | Copied from Vendor.reason |
| Vendor.sequence_number | event.sequence | TCP sequence number for connection tracking | Copied from Vendor.sequence_number |
| Vendor.action, log.syslog.appname | event.type[] | Event type classification array | Array populated based on conditions and log type |
| log.syslog.hostname | host.hostname | Host system name | Transformed from log.syslog.hostname using lowercase |
| None | log.syslog.appname | Syslog application name | Extracted from syslog header using regex |
| None | log.syslog.hostname | Syslog hostname field | Extracted from syslog header using regex |
| None | log.syslog.msgid | Syslog message identifier | Extracted from RFC 5424 syslog header |
| None | log.syslog.priority | Syslog priority value | Extracted from syslog header using regex |
| None | log.syslog.procid | Syslog process identifier | Extracted from syslog header using regex |
| None | log.syslog.structured_data | Syslog structured data element | Extracted from RFC 5424 syslog header |
| None | log.syslog.version | Syslog protocol version | Extracted from RFC 5424 syslog header |
| Vendor.message | message | Original log message content | Copied from Vendor.message |
| Vendor.length | network.bytes | Total bytes in the network packet | Copied from Vendor.length |
| Vendor.direction | network.direction | Network traffic direction | Transformed from Vendor.direction: "inbound" or "outbound" |
| Vendor.protocol_id | network.iana_number | IANA protocol number | Copied from Vendor.protocol_id |
| None | network.protocol | Application layer protocol | Static value: "dhcp" for DHCP logs |
| Vendor.protocol_text | network.transport | Network transport protocol | Transformed from Vendor.protocol_text using lowercase |
| Vendor.ip_version | network.type | Network layer protocol type | Static value based on IP version: "ipv4" or "ipv6" |
| Vendor.real_interface | observer.egress.interface.name | Egress network interface name | Copied from Vendor.real_interface for outbound traffic |
| Vendor.vlan_id | observer.egress.vlan.id | Egress VLAN identifier | Copied from Vendor.vlan_id for egress traffic |
| Vendor.real_interface | observer.ingress.interface.name | Ingress network interface name | Copied from Vendor.real_interface for inbound traffic |
| Vendor.vlan_id | observer.ingress.vlan.id | Ingress VLAN identifier | Copied from Vendor.vlan_id for ingress traffic |
| log.syslog.hostname | observer.name | Observer hostname | Copied from log.syslog.hostname |
| event.module | observer.product | Observer product identifier | Static value: "pfsense" |
| Vendor | observer.vendor | Observer vendor identifier | Static value: "netgate" |
| log.syslog.appname | process.name | Process name generating the log | Copied from log.syslog.appname |
| log.syslog.procid | process.pid | Process identifier | Copied from log.syslog.procid |
| Vendor.rule_number | rule.id | Firewall rule identifier | Copied from Vendor.rule_number |
| server.ip, server.domain | server.address | DHCP server network address | Coalesced from server.ip and server.domain |
| observer.name | server.domain | DHCP server domain name | Copied from observer.name |
| source.ip, source.domain | source.address | Source network address | Coalesced from source.ip and source.domain |
| client.domain, source.ip | source.domain | Source domain name | Copied from client.domain or transformed from IP |
| Vendor.src_ip | source.ip | Source IP address | Copied from Vendor.src_ip with IP validation |
| client.mac | source.mac | Source MAC address | Copied from client.mac with formatting |
| Vendor.src_port | source.port | Source port number | Copied from Vendor.src_port |
| user.name | user.effective.name | Effective username for login events | Copied from user.name |
| Vendor.message | user.name | Username from login events | Extracted from login message using regex |