Parsers and Generated Fields

Tag Fields Created by Parser zscaler-internetaccess

  • #Cps.version

  • #Vendor

  • #ecs.version

  • #event.dataset

  • #event.kind

  • #event.module

  • #event.outcome

  • #observer.type

Fields Identified by Parser zscaler-internetaccess
Source FieldCPS FieldDescriptionMapping
Vendor.datetime, Vendor.time@timestampEvent timestampParsed from datetime fields using multiple format patterns
Vendor.clt_sip, Vendor.csip, Vendor.ClientIPclient.addressClient addressMapped from vendor IP/address fields based on sourcetype
client.addressclient.domainClient domainSet when client.address does not match IP CIDR patterns
client.addressclient.ipClient IP addressSet when client.address matches IP CIDR patterns
Vendor.clt_sportclient.portClient source port (web events)Copied from Vendor.clt_sport
Vendor.srv_dip, Vendor.cdip, Vendor.serverip, Vendor.destinationipdestination.addressDestination addressMapped from vendor IP/address fields based on sourcetype
Vendor.inbytes, Vendor.rxbytesdestination.bytesDestination bytes transferredMapped from vendor byte fields based on sourcetype
destination.address, Vendor.hostnamedestination.domainDestination domainSet when destination.address does not match IP CIDR patterns, or copied from Vendor.hostname
Vendor.destcountrydestination.geo.country_nameDestination country nameCopied from Vendor.destcountry
destination.addressdestination.ipDestination IP addressSet when destination.address matches IP CIDR patterns
Vendor.srv_dport, Vendor.cdport, Vendor.destinationportdestination.portDestination portMapped from vendor port fields based on sourcetype
Vendor.dns_respdns.answers[0].dataDNS response dataCopied from Vendor.dns_resp
Vendor.dns_reqdns.question.nameDNS query nameCopied from Vendor.dns_req
Vendor.dns_reqtypedns.question.typeDNS query record typeCopied from Vendor.dns_reqtype
Noneecs.versionECS schema versionStatic value: 9.4.0
Vendor.action, Vendor.actiontakenevent.actionAction takenCopied from Vendor.action or Vendor.actiontaken and converted to lowercase
Vendor.sourcetype, Vendor.action, Vendor.threatnameevent.category[]Event category arrayArray populated based on sourcetype and action conditions
Vendor.sourcetypeevent.datasetDataset classificationSet based on sourcetype mapping
Vendor.recordidevent.idEvent identifierCopied from Vendor.recordid
Vendor.threatnameevent.kindEvent kind classificationStatic value: event, changed to alert when threatname is present and not "None"
Noneevent.moduleEvent module identifierStatic value: zia
@rawstringevent.originalOriginal event dataSet to @rawstring for first event in multi-event logs
@rawstringevent.original.hash.sha256Hash of original eventSHA256 hash of @rawstring for multi-event logs
Vendor.result, Vendor.actionevent.outcomeEvent outcome (success/failure)Set based on Vendor.result pattern matching and web event action types
Vendor.reason, Vendor.eventreasonevent.reasonReason for the eventCopied from Vendor.reason or Vendor.eventreason
Vendor.riskscoreevent.risk_scoreRisk scoreCopied from Vendor.riskscore
Vendor.severityevent.severityEvent severity level (90=critical, 70=high, 50=medium, 30=low, 10=info)Mapped from Vendor.severity using severity level pattern matching
Vendor.sourcetype, Vendor.action, Vendor.filename, Vendor.upload_filename, Vendor.threatnameevent.type[]Event type arrayArray populated based on sourcetype, action, and file conditions
Vendor.filesourcefile.directoryFile directory pathCopied from Vendor.filesource
Vendor.filesubtype, Vendor.upload_filesubtype, Vendor.filetypenamefile.extensionFile extensionConditionally set from download or upload file extension, or from filetypename for DLP events
Vendor.bamd5, Vendor.filemd5file.hash.md5File MD5 hashCopied from vendor MD5 fields, converted to lowercase, excludes values matching /none/i
Vendor.lastmodtimefile.mtimeFile last modification timeParsed from Vendor.lastmodtime using format "E MMM [ ]d HH:mm:ss yyyy" when field is present
Vendor.filename, Vendor.upload_filenamefile.nameFile nameConditionally set using coalesce from download or upload filename based on availability
Vendor.ownerfile.ownerFile ownerCopied from Vendor.owner
Vendor.filetype, Vendor.upload_filetypefile.typeFile typeConditionally set from download or upload file type based on availability
Vendor.companygroup.nameGroup or organization nameCopied from Vendor.company
Vendor.devicehostnamehost.hostnameHost hostname (firewall events)Copied from Vendor.devicehostname and converted to lowercase
Vendor.devicehostnamehost.nameHost name (web events)Copied from Vendor.devicehostname and converted to lowercase
Vendor.requestsizehttp.request.bytesHTTP request size in bytesCopied from Vendor.requestsize
Vendor.requestmethodhttp.request.methodHTTP request methodCopied from Vendor.requestmethod
Vendor.contenttypehttp.request.mime_typeHTTP request MIME typeCopied from Vendor.contenttype
Vendor.refererURLhttp.request.referrerHTTP referrer URLBase64 decoded from Vendor.refererURL
Vendor.responsesizehttp.response.bytesHTTP response size in bytesCopied from Vendor.responsesize
Vendor.statushttp.response.status_codeHTTP response status codeCopied from Vendor.status when value is not wildcard or "NA"
Vendor.nwappnetwork.applicationNetwork application nameCopied from Vendor.nwapp
Vendor.policydirectionnetwork.directionNetwork traffic directionSet based on Vendor.policydirection pattern matching (Inbound/Outbound/unknown)
Vendor.protocol, Vendor.nwsvcnetwork.protocolNetwork protocolMapped from vendor protocol fields and converted to lowercase
Vendor.protonetwork.transportNetwork transport protocolCopied from Vendor.proto and converted to lowercase
Vendor.tunneltypenetwork.typeNetwork/tunnel typeCopied from Vendor.tunneltype and converted to lowercase
Vendor.rulelabel, Vendor.rulename, Vendor.policy, Vendor.threatnamerule.nameRule or threat nameMapped from vendor rule or threat name fields depending on sourcetype and threat presence
Vendor.ruletyperule.rulesetRule set nameCopied from Vendor.ruletype
Vendor.srv_dip, Vendor.cdip, Vendor.serveripserver.addressServer addressMapped from vendor IP/address fields based on sourcetype
server.addressserver.domainServer domainSet when server.address does not match IP CIDR patterns
server.addressserver.ipServer IP addressSet when server.address matches IP CIDR patterns
Vendor.clt_sip, Vendor.csip, Vendor.ClientIP, Vendor.sourceipsource.addressSource addressMapped from vendor IP/address fields based on sourcetype
Vendor.outbytes, Vendor.txbytessource.bytesSource bytes transferredMapped from vendor byte fields based on sourcetype
source.addresssource.domainSource domainSet when source.address does not match IP CIDR patterns
Vendor.locationsource.geo.nameSource geographic location nameCopied from Vendor.location
source.addresssource.ipSource IP addressSet when source.address matches IP CIDR patterns
Vendor.ClientIP, Vendor.clientpublicIPsource.nat.ipSource NAT IP addressSet when source.ip differs from Vendor.clientpublicIP
Vendor.csport, Vendor.sourceportsource.portSource portMapped from vendor port fields based on sourcetype
Vendor.hostnameurl.domainURL domainCopied from Vendor.hostname
Vendor.fullurlurl.fullFull URL (CASB file events)Copied from Vendor.fullurl
Vendor.urlurl.originalOriginal URLBase64 decoded from Vendor.url
Vendor.urlurl.pathURL path componentExtracted from URL parsing of url.original
Vendor.elogin, Vendor.login, Vendor.user, Vendor.adminiduser.domainUser domainExtracted from domain part of email using regex
Vendor.elogin, Vendor.login, Vendor.user, Vendor.adminiduser.emailUser email addressSet to coalesced username value when it contains @ symbol
Vendor.elogin, Vendor.login, Vendor.user, Vendor.adminiduser.idUser identifierSet equal to user.email when a valid email is detected
Vendor.elogin, Vendor.login, Vendor.user, Vendor.adminiduser.nameUsernameExtracted from local part of email, or copied directly when no @ symbol present
Vendor.useragentuser_agent.originalOriginal user agent stringURL decoded from Vendor.useragent