Parsers and Generated Fields

Tag Fields Created by Parser zscaler-internetaccess

  • #Cps.version

  • #Vendor

  • #ecs.version

  • #event.dataset

  • #event.kind

  • #event.module

  • #event.outcome

  • #observer.type

Fields Identified by Parser zscaler-internetaccess
Source FieldCPS FieldDescriptionMapping
Vendor.datetime, Vendor.time@timestampEvent timestampParsed from datetime fields using multiple format patterns
Vendor.clt_sip, Vendor.csip, Vendor.ClientIPclient.addressClient addressMapped from various vendor IP/address fields based on sourcetype
client.addressclient.domainClient domainSet when client.address doesn't match IP CIDR patterns
client.addressclient.ipClient IP addressSet when client.address matches IP CIDR patterns
Vendor.clt_sportclient.portClient portCopied from Vendor.clt_sport
Vendor.srv_dip, Vendor.cdip, Vendor.serverip, Vendor.destinationipdestination.addressDestination addressMapped from various vendor IP/address fields based on sourcetype
Vendor.inbytes, Vendor.rxbytesdestination.bytesDestination bytesMapped from various vendor byte fields based on sourcetype
destination.address, Vendor.hostnamedestination.domainDestination domainSet when destination.address doesn't match IP CIDR patterns or copied from hostname
Vendor.destcountrydestination.geo.country_nameDestination countryCopied from Vendor.destcountry
destination.addressdestination.ipDestination IP addressSet when destination.address matches IP CIDR patterns
Vendor.srv_dport, Vendor.sdport, Vendor.cdport, Vendor.destinationportdestination.portDestination portMapped from various vendor port fields based on sourcetype
Vendor.dns_respdns.answers[0].dataDNS response dataCopied from Vendor.dns_resp
Vendor.dns_reqdns.question.nameDNS query nameCopied from Vendor.dns_req
Vendor.dns_reqtypedns.question.typeDNS query typeCopied from Vendor.dns_reqtype
Noneecs.versionECS schema versionStatic value: 9.2.0
Vendor.actionevent.actionAction takenCopied from Vendor.action and converted to lowercase
Vendor.sourcetypeevent.category[]Event category arrayArray populated based on sourcetype conditions
Vendor.sourcetypeevent.datasetDataset classificationSet based on sourcetype mapping
Vendor.recordidevent.idEvent identifierCopied from Vendor.recordid
Vendor.threatnameevent.kindEvent kind classificationStatic value: event, changed to alert when threatname present
Noneevent.moduleEvent module identifierStatic value: zia
@rawstringevent.originalOriginal event dataSet to @rawstring for first event in multi-event logs
@rawstringevent.original.hash.sha256Hash of original eventSHA256 hash of @rawstring for multi-event logs
Vendor.result, Vendor.actionevent.outcomeEvent outcomeSet based on Vendor.result matching patterns and action types
Vendor.reasonevent.reasonReason for the eventCopied from Vendor.reason
Vendor.riskscoreevent.risk_scoreRisk scoreCopied from Vendor.riskscore
Vendor.severityevent.severityEvent severity levelMapped from Vendor.severity using severity mapping logic
Vendor.sourcetype, Vendor.action, Vendor.threatnameevent.type[]Event type arrayArray populated based on conditions and actions
Vendor.filesourcefile.directoryFile directoryCopied from Vendor.filesource
Vendor.filesubtype, Vendor.upload_filesubtype, Vendor.filetypenamefile.extensionFile extensionConditionally set from download or upload file extension based on availability
Vendor.bamd5, Vendor.filemd5file.hash.md5File MD5 hashCopied from various vendor MD5 fields, converted to lowercase, excludes "none" values
Vendor.lastmodtimefile.mtimeFile modification timeParsed from Vendor.lastmodtime when present
Vendor.filename, Vendor.upload_filenamefile.nameFile nameConditionally set using coalesce function from download or upload filename
Vendor.ownerfile.ownerFile ownerCopied from Vendor.owner
Vendor.filetype, Vendor.upload_filetypefile.typeFile typeConditionally set from download or upload file type based on availability
Vendor.companygroup.nameGroup nameCopied from Vendor.company
Vendor.devicehostnamehost.hostnameHost hostnameCopied from Vendor.devicehostname and converted to lowercase
Vendor.devicehostnamehost.nameHost nameCopied from Vendor.devicehostname and converted to lowercase
Vendor.requestsizehttp.request.bytesHTTP request sizeCopied from Vendor.requestsize
Vendor.requestmethodhttp.request.methodHTTP request methodCopied from Vendor.requestmethod
Vendor.contenttypehttp.request.mime_typeHTTP request MIME typeCopied from Vendor.contenttype
Vendor.refererURLhttp.request.referrerHTTP referrer URLBase64 decoded from Vendor.refererURL
Vendor.responsesizehttp.response.bytesHTTP response sizeCopied from Vendor.responsesize
Vendor.statushttp.response.status_codeHTTP response status codeCopied from Vendor.status when not wildcard or "NA"
Vendor.nwappnetwork.applicationNetwork applicationCopied from Vendor.nwapp
Vendor.policydirectionnetwork.directionNetwork directionSet based on Vendor.policydirection pattern matching
Vendor.protocol, Vendor.nwsvcnetwork.protocolNetwork protocolMapped from various vendor protocol fields and converted to lowercase
Vendor.protonetwork.transportNetwork transport protocolCopied from Vendor.proto and converted to lowercase
Vendor.tunneltypenetwork.typeNetwork typeCopied from Vendor.tunneltype and converted to lowercase
Vendor.rulelabel, Vendor.rulename, Vendor.policy, Vendor.threatnamerule.nameRule nameMapped from various vendor rule/threat fields
Vendor.ruletyperule.rulesetRule setCopied from Vendor.ruletype
Vendor.srv_dip, Vendor.cdip, Vendor.serveripserver.addressServer addressMapped from various vendor IP/address fields based on sourcetype
server.addressserver.domainServer domainSet when server.address doesn't match IP CIDR patterns
server.addressserver.ipServer IP addressSet when server.address matches IP CIDR patterns
Vendor.clt_sip, Vendor.csip, Vendor.ClientIP, Vendor.sourceipsource.addressSource addressMapped from various vendor IP/address fields based on sourcetype
Vendor.outbytes, Vendor.txbytessource.bytesSource bytesMapped from various vendor byte fields based on sourcetype
source.addresssource.domainSource domainSet when source.address doesn't match IP CIDR patterns
Vendor.locationsource.geo.nameSource geographic locationCopied from Vendor.location
source.addresssource.ipSource IP addressSet when source.address matches IP CIDR patterns
Vendor.ClientIP, Vendor.clientpublicIPsource.nat.ipSource NAT IPSet when source.ip differs from clientpublicIP
Vendor.csport, Vendor.sourceport, Vendor.clt_sportsource.portSource portMapped from various vendor port fields based on sourcetype
Vendor.hostnameurl.domainURL domainCopied from Vendor.hostname
Vendor.fullurlurl.fullFull URLCopied from Vendor.fullurl
Vendor.urlurl.originalOriginal URLBase64 decoded from Vendor.url
Vendor.urlurl.pathURL pathExtracted from URL parsing
Vendor.user, Vendor.elogin, Vendor.login, Vendor.adminiduser.domainUser domainExtracted from user email domain part and converted to lowercase
Vendor.user, Vendor.elogin, Vendor.login, Vendor.adminiduser.emailUser email addressSet only when valid email format detected, converted to lowercase
Vendor.user, Vendor.elogin, Vendor.login, Vendor.adminiduser.nameUsernameExtracted from user email or copied using coalesce function
Vendor.useragentuser_agent.originalUser agent stringURL decoded from Vendor.useragent