Parsers and Generated Fields

Tag Fields Created by Parser zscaler-deception

  • #Cps.version

  • #Vendor

  • #ecs.version

  • #event.dataset

  • #event.kind

  • #event.module

  • #event.outcome

  • #observer.type

Fields Identified by Parser zscaler-deception
Vendor FieldCPS FieldDescription
`event.category[]`ArrayVendor.module, Vendor.description, Vendor.type, Vendor.sub_type
`event.type[]`ArrayVendor.module, Vendor.description, Vendor.type, Vendor.sub_type
`threat.tactic.name[]`ArrayVendor.sub_type
`threat.technique.id[]`ArrayVendor.mitre_ids
`destination.address`Coalesceddestination.ip, destination.domain
`destination.domain`CoalescedVendor.decoy.name, Vendor.recon.server_name
`file.hash.md5`CoalescedVendor.attacker.process.md5, Vendor.file.hash.md5
`file.hash.sha1`CoalescedVendor.attacker.process.sha1, Vendor.file.hash.sha1
`file.hash.sha256`CoalescedVendor.attacker.process.sha256, Vendor.file.hash.sha256
`http.request.method`CoalescedVendor.recon.method, Vendor.web.method, Vendor.method
`http.response.bytes`CoalescedVendor.web.bytes_sent, Vendor.recon.bytes_sent
`http.response.status_code`CoalescedVendor.web.status, Vendor.recon.status, Vendor.status_code
`log.level`CoalescedVendor.severity, Vendor.threat.alert.severity
`network.protocol`CoalescedVendor.recon.scheme, Vendor.web.scheme
`process.command_line`CoalescedVendor.linux.command_line, Vendor.attacker.process.command_line
`process.executable`CoalescedVendor.attacker.process.executable_path, Vendor.linux.process_name
`process.name`CoalescedVendor.linux.process_name, Vendor.attacker.process.name
`source.address`Coalescedsource.ip, source.domain
`url.domain`CoalescedVendor.recon.host, Vendor.web.host
`url.original`CoalescedVendor.recon.uri, Vendor.web.uri
`url.path`CoalescedVendor.recon.request_uri, Vendor.recon.uri, Vendor.web.request_uri, Vendor.url
`url.scheme`CoalescedVendor.recon.scheme, Vendor.web.scheme
`user_agent.original`CoalescedVendor.web.user_agent.string, Vendor.recon.user_agent.string
`user_agent.version`CoalescedVendor.web.user_agent.patch, Vendor.recon.user_agent.patch
`event.dataset`ConditionalVendor.module
`event.outcome`ConditionalVendor.status_code, Vendor.username, Vendor.description
`agent.version`CopiedVendor.landmine.version
`client.address`Copiedsource.address
`client.bytes`Copiedsource.bytes
`client.domain`Copiedsource.domain
`client.ip`Copiedsource.ip
`client.packets`Copiedsource.packets
`client.port`Copiedsource.port
`cloud.instance.id`CopiedVendor.azure.resourceId
`cloud.service.name`CopiedVendor.azure.operationName
`container.name`CopiedVendor.linux.container_name
`destination.bytes`CopiedVendor.network.resp_ip_bytes
`destination.ip`CopiedVendor.decoy.ip
`destination.packets`CopiedVendor.network.resp_pkts
`destination.port`CopiedVendor.decoy.port
`event.id`CopiedVendor.id
`event.reason`CopiedVendor.description
`event.risk_score`CopiedVendor.score
`file.path`CopiedVendor.file.name
`network.name`CopiedVendor.decoy.network_name
`network.transport`CopiedVendor.network.protocol
`observer.name`CopiedVendor.decoy.appliance.name
`process.hash.md5`CopiedVendor.attacker.process.md5
`process.hash.sha1`CopiedVendor.attacker.process.sha1
`process.hash.sha256`CopiedVendor.attacker.process.sha256
`process.parent.name`CopiedVendor.linux.parent_process_name
`process.parent.pid`CopiedVendor.linux.ppid
`process.pid`CopiedVendor.linux.pid
`process.user.name`CopiedVendor.linux.user
`rule.id`CopiedVendor.threat.alert.signature_id
`rule.name`CopiedVendor.threat.alert.signature
`server.address`Copieddestination.address
`server.bytes`Copieddestination.bytes
`server.domain`Copieddestination.domain
`server.ip`Copieddestination.ip
`server.packets`Copieddestination.packets
`server.port`Copieddestination.port
`source.bytes`CopiedVendor.network.orig_ip_bytes
`source.geo.country_name`CopiedVendor.attacker.country
`source.ip`CopiedVendor.attacker.ip
`source.packets`CopiedVendor.network.orig_pkts
`source.port`CopiedVendor.attacker.port
`threat.indicator.name`CopiedVendor.attacker.name
`threat.indicator.port`CopiedVendor.attacker.port
`threat.indicator.type`CopiedVendor.type
`tls.cipher`CopiedVendor.ssl.cipher
`tls.version`CopiedVendor.ssl.version
`user.id`CopiedVendor.azure.identity.claim.oid
`http.version`ExtractedVendor.recon.server_protocol, Vendor.web.server_protocol
`threat.indicator.ip`ExtractedVendor.attacker.ip, Vendor.abuseip.ipAddress
`user.email`ExtractedVendor.description, Vendor.attacker.zcc_user
`user.full_name`ExtractedVendor.username
`user.name`ExtractedVendor.username
`source.domain`LowercasedVendor.attacker.name
`event.severity`Mappedlog.level
`@timestamp`ParsedVendor.timestamp
`network.type`SetVendor.attacker.ip, Vendor.decoy.ip
`ecs.version`StaticNone
`event.kind`StaticNone
`event.module`StaticNone
Vendor.landmine.versionagent.version 
source.addressclient.address 
source.bytesclient.bytes 
source.domainclient.domain 
source.ipclient.ip 
source.packetsclient.packets 
source.portclient.port 
Vendor.azure.resourceIdcloud.instance.id 
Vendor.azure.operationNamecloud.service.name 
Vendor.linux.container_namecontainer.name 
Vendor.network.resp_ip_bytesdestination.bytes 
Vendor.decoy.ipdestination.ip 
Vendor.network.resp_pktsdestination.packets 
Vendor.decoy.portdestination.port 
Vendor.idevent.id 
Vendor.descriptionevent.reason 
Vendor.scoreevent.risk_score 
Vendor.file.namefile.path 
Vendor.methodhttp.request.method 
Vendor.status_codehttp.response.status_code 
Vendor.decoy.network_namenetwork.name 
Vendor.network.protocolnetwork.transport 
Vendor.decoy.appliance.nameobserver.name 
Vendor.attacker.process.md5process.hash.md5 
Vendor.attacker.process.sha1process.hash.sha1 
Vendor.attacker.process.sha256process.hash.sha256 
Vendor.linux.parent_process_nameprocess.parent.name 
Vendor.linux.ppidprocess.parent.pid 
Vendor.linux.pidprocess.pid 
Vendor.linux.userprocess.user.name 
Vendor.threat.alert.signature_idrule.id 
Vendor.threat.alert.signaturerule.name 
destination.addressserver.address 
destination.bytesserver.bytes 
destination.domainserver.domain 
destination.ipserver.ip 
destination.packetsserver.packets 
destination.portserver.port 
Vendor.network.orig_ip_bytessource.bytes 
Vendor.attacker.countrysource.geo.country_name 
Vendor.attacker.ipsource.ip 
Vendor.network.orig_pktssource.packets 
Vendor.attacker.portsource.port 
Vendor.abuseip.ipAddressthreat.indicator.ip 
Vendor.attacker.namethreat.indicator.name 
Vendor.attacker.portthreat.indicator.port 
Vendor.typethreat.indicator.type 
Vendor.ssl.ciphertls.cipher 
Vendor.ssl.versiontls.version 
Vendor.urlurl.path 
Vendor.attacker.zcc_useruser.email 
Vendor.azure.identity.claim.oiduser.id 
Vendor.usernameuser.name