Parsers and Generated Fields
Tag Fields Created by Parser rubrik-securitycloud
#Cps.version
#Vendor
#ecs.version
#event.dataset
#event.kind
#event.module
#event.outcome
#observer.type
Fields Identified by Parser rubrik-securitycloud
| Source Field | CPS Field | Description | Mapping |
|---|---|---|---|
| None | ecs.version | ECS schema version | Static value: 9.3.0 |
| Vendor.errorCode | error.code | Error code identifier | Copied from Vendor.errorCode when errorId exists |
| Vendor.errorId | error.id | Error identifier | Copied from Vendor.errorId when present |
| Vendor.errorReason | error.message | Error message description | Copied from Vendor.errorReason when errorId exists |
| Vendor.eventName | event.action | Name of the event action | Copied from Vendor.eventName |
| None | event.category[] | Event category classification | Static array value: vulnerability |
| Vendor.id | event.id | Unique event identifier | Copied from Vendor.id |
| None | event.kind | Event kind classification | Static value: event |
| None | event.module | Module name for the event source | Static value: securitycloud |
| Vendor.status | event.outcome | Event outcome based on status (success/failure/unknown) | Mapped from Vendor.status using conditional logic |
| Vendor.severity | event.severity | Numeric severity level based on text severity | Mapped from Vendor.severity using conditional logic |
| None | event.type[] | Event type classification | Static array value: info |
| Vendor.auditUserId | user.id | User identifier | Copied from Vendor.auditUserId |
| Vendor.auditUserName | user.name | Username | Copied from Vendor.auditUserName |