Parsers and Generated Fields

Tag Fields Created by Parser zscaler-privateaccess

  • #Cps.version

  • #Vendor

  • #ecs.version

  • #event.dataset

  • #event.kind

  • #event.module

  • #event.outcome

  • #observer.type

Fields Identified by Parser zscaler-privateaccess
Source FieldCPS FieldDescriptionMapping
Vendor.LogTimestamp, Vendor.ModifiedTime, Vendor.CreationTime, Vendor.start@timestampEvent timestampParsed from timestamp fields using parseTimestamp()
source.addressclient.addressClient network addressCopied from source.address
Vendor.TotalBytesTx, Vendor.ZENTotalBytesTxClientclient.bytesTotal bytes sent by clientCopied from source.bytes
source.domainclient.domainClient domain nameCopied from source.domain
Vendor.Cityclient.geo.city_nameClient's city nameCopied from source.geo.city_name
Vendor.CountryCode, Vendor.ClientCountryCodeclient.geo.country_iso_codeClient's country ISO codeCopied from source.geo.country_iso_code
Vendor.Latitude, Vendor.ClientLatitudeclient.geo.location.latClient's latitude coordinateCopied from source.geo.location.lat
Vendor.Longitude, Vendor.ClientLongitudeclient.geo.location.lonClient's longitude coordinateCopied from source.geo.location.lon
source.ipclient.ipClient's IP addressCopied from source.ip
Vendor.ClientPrivateIp, Vendor.ClientPrivateIPclient.nat.ipClient's NAT IP addressCopied from source.nat.ip
Vendor.ClientPort, Vendor.ClientPublicPortclient.portClient's port numberCopied from source.port
Vendor.Destination, Vendor.Domain, Vendor.Host, Vendor.ServerIPdestination.addressDestination network addressExtracted from vendor fields with address normalization using coalesce
Vendor.ZENTotalBytesRxClientdestination.bytesTotal bytes received at destinationCopied from field
destination.addressdestination.domainDestination domain nameExtracted when destination.address is not an IP
destination.addressdestination.ipDestination IP addressExtracted when destination.address is an IP
Vendor.dstdestination.nat.ipDestination NAT IP addressCopied from field
Vendor.ServerPort, Vendor.ServicePort, Vendor.dptdestination.portDestination port numberCopied from field using coalesce
Noneecs.versionECS schema versionStatic value: 9.4.0
Vendor.AuditOperationTypeevent.actionType of action performedCopied from field
Noneevent.category[]Event categorization arrayArray populated based on dataset and conditions
Vendor.CreationTimeevent.createdEvent creation timestampCopied from field
Vendor.sourcetypeevent.datasetDataset identifierDetermined from Vendor.sourcetype or field analysis
Vendor.TimestampUnAuthentication, Vendor.TimestampResponseTransmitFinish, Vendor.TimestampConnectionEnd, Vendor.endevent.endEvent end timeCopied from timestamp fields using coalesce
Vendor.RequestIDevent.idUnique event identifierCopied from field
Noneevent.kindEvent kind classificationStatic value based on dataset
Noneevent.moduleModule identifierStatic value: zpa
Vendor.AuditOldValueevent.originalOriginal event data before changeCopied from field
Vendor.StatusCode, Vendor.InternalReason, Vendor.ConnectionStatus, Vendor.Actions[]event.outcomeEvent outcomeDetermined from status codes and connection conditions
Vendor.InternalReason, Vendor.ConnectionReasonevent.reasonReason for the eventCopied from field
Vendor.TimestampAuthentication, Vendor.TimestampRequestReceiveStart, Vendor.TimestampConnectionStart, Vendor.startevent.startEvent start timeCopied from timestamp fields using coalesce
Noneevent.type[]Event type classification arrayArray populated based on conditions
Vendor.AuditNewValue.id, Vendor.AuditOldValue.idgroup.idGroup identifierCopied from audit value fields
Vendor.AuditNewValue.name, Vendor.AuditOldValue.namegroup.nameGroup nameCopied from audit value fields
Vendor.CPUUtilizationhost.cpu.usageCPU utilization as decimal (0-1)Copied from field with percentage conversion (divided by 100)
Vendor.CountryCodehost.geo.country_iso_codeHost country ISO codeCopied from field
Vendor.Latitudehost.geo.location.latHost latitude coordinateCopied from field
Vendor.Longitudehost.geo.location.lonHost longitude coordinateCopied from field
Vendor.Hostnamehost.hostnameSystem hostnameCopied from field with lowercase transformation
Vendor.PublicIP, Vendor.PrivateIPhost.ip[]Host IP addressesArray populated from IP fields
Vendor.Connector, Vendor.PrivateCloudController, Vendor.ServiceEdge, Vendor.PrivateSEhost.nameHost nameCopied from field
Vendor.TotalBytesTx, Vendor.TransmittedBytesToPublicSE, Vendor.TransmittedBytesToPrivateSE, Vendor.BytesTxInterfacehost.network.egress.bytesHost outbound network bytesCalculated from vendor fields
Vendor.PacketsTxInterfacehost.network.egress.packetsHost outbound network packetsCopied from field
Vendor.TotalBytesRx, Vendor.ReceivedBytesFromPublicSE, Vendor.ReceivedBytesFromPrivateSE, Vendor.BytesRxInterfacehost.network.ingress.bytesHost inbound network bytesCalculated from vendor fields
Vendor.PacketsRxInterfacehost.network.ingress.packetsHost inbound network packetsCopied from field
Vendor.Platformhost.os.platformOperating system platformCopied from field
Vendor.HostUpTimehost.uptimeHost uptime in secondsCopied from field
Vendor.RequestBodySizehttp.request.body.bytesHTTP request body size in bytesCopied from field
Vendor.RequestHdrSize, Vendor.RequestBodySize, Vendor.RequestSizehttp.request.bytesTotal HTTP request bytesCalculated from header and body sizes
Vendor.Methodhttp.request.methodHTTP request methodCopied from field
Vendor.ResponseBodySizehttp.response.body.bytesHTTP response body size in bytesCopied from field
Vendor.ResponseHdrSize, Vendor.ResponseBodySize, Vendor.ResponseSizehttp.response.bytesTotal HTTP response bytesCalculated from header and body sizes
Vendor.ContentTypehttp.response.mime_typeHTTP response content MIME typeCopied from field
Vendor.StatusCodehttp.response.status_codeHTTP response status codeCopied from field
Vendor.ProtocolVersionhttp.versionHTTP protocol versionCopied from field
Vendor.Applicationnetwork.applicationNetwork application nameCopied from field with lowercase transformation
Multiple vendor byte fieldsnetwork.bytesTotal network bytes transferredCalculated from various byte fields
Vendor.XFFnetwork.forwarded_ipX-Forwarded-For IP addressCopied from field
Vendor.IPProtocol, Vendor.protonetwork.iana_numberIANA protocol numberCopied from field using coalesce
Vendor.Protocol, Vendor.InspectionProtocolConfignetwork.protocolNetwork protocol nameCopied from field with lowercase transformation using coalesce
network.iana_number (indirect)network.transportTransport layer protocol nameDetermined from network.iana_number via match statement
Vendor.AuditNewValue.cityCountry, Vendor.AuditOldValue.cityCountryobserver.geo.city_nameObserver city nameCopied from audit value fields
Vendor.CountryCode, Vendor.ZENCountryCodeobserver.geo.country_iso_codeObserver country ISO codeCopied from field
Vendor.AuditNewValue.location, Vendor.AuditOldValue.locationobserver.geo.country_nameObserver country nameCopied from audit value fields
Vendor.Latitude, Vendor.ZENLatitudeobserver.geo.location.latObserver latitude coordinateCopied from field
Vendor.Longitude, Vendor.ZENLongitudeobserver.geo.location.lonObserver longitude coordinateCopied from field
Vendor.PublicIPobserver.ip[]Observer IP addressesArray populated from IP fields
Vendor.Connector, Vendor.Exporter, Vendor.ClientZEN, Vendor.ZEN, Vendor.PrivateCloudController, Vendor.ServiceEdge, Vendor.PrivateSEobserver.nameObserver nameCopied from field
Vendor.Platformobserver.os.platformObserver operating system platformCopied from field
Vendor.Versionobserver.versionObserver software versionCopied from field
Vendor.CustomerIDorganization.idOrganization identifierCopied from field
Vendor.Customerorganization.nameOrganization nameCopied from field
Vendor.InspectionPolicy, Vendor.Policyrule.nameSecurity rule nameCopied from field
Vendor.InspectionProfilerule.rulesetSecurity rule set nameCopied from field
destination.addressserver.addressServer network addressCopied from destination.address
Vendor.TotalBytesRx, destination.bytesserver.bytesServer bytes transmittedCopied from field
destination.domainserver.domainServer domain nameCopied from destination.domain
destination.ipserver.ipServer IP addressCopied from destination.ip
destination.portserver.portServer port numberCopied from destination.port
Vendor.Applicationservice.nameService nameCopied from field
Vendor.PrivateCloudControllerservice.node.nameService node nameCopied from field
Vendor.Versionservice.versionService versionCopied from field
Vendor.ClientPublicIp, Vendor.ClientPublicIP, Vendor.ClientPrivateIP, Vendor.PublicIP, Vendor.AuditOldValue.remoteIP, Vendor.AuditNewValue.remoteIPsource.addressSource network addressExtracted from vendor fields with address normalization using coalesce and lowercase
Vendor.ZENTotalBytesTxClient, Vendor.TotalBytesTxsource.bytesSource bytes transmittedCopied from field
source.addresssource.domainSource domain nameExtracted when source.address is not an IP
Vendor.Citysource.geo.city_nameSource city nameCopied from field
Vendor.CountryCode, Vendor.ClientCountryCodesource.geo.country_iso_codeSource country ISO codeCopied from field
Vendor.Latitude, Vendor.ClientLatitudesource.geo.location.latSource latitude coordinateCopied from field
Vendor.Longitude, Vendor.ClientLongitudesource.geo.location.lonSource longitude coordinateCopied from field
source.addresssource.ipSource IP addressExtracted when source.address is an IP
Vendor.ClientPrivateIp, Vendor.ClientPrivateIP, Vendor.PrivateIPsource.nat.ipSource NAT IP addressCopied from field using coalesce
Vendor.ClientPort, Vendor.ClientPublicPortsource.portSource port numberCopied from field
Vendor.AuditNewValue.subjectAlternateNames, Vendor.AuditOldValue.subjectAlternateNamestls.client.x509.alternative_names[]Certificate subject alternative namesArray populated from audit value certificate fields
Vendor.AuditNewValue.commonName, Vendor.AuditOldValue.commonNametls.client.x509.issuer.common_name[]Certificate issuer common nameArray populated from certificate fields
Vendor.AuditNewValue.issuedTo, Vendor.AuditOldValue.issuedTotls.client.x509.issuer.distinguished_nameCertificate issuer distinguished nameCopied from audit value fields
Vendor.AuditNewValue.expirationTimeInSeconds, Vendor.AuditOldValue.expirationTimeInSecondstls.client.x509.not_afterCertificate expiration timeCopied from audit value fields
Vendor.AuditNewValue.creationTimeInSeconds, Vendor.AuditOldValue.creationTimeInSecondstls.client.x509.not_beforeCertificate creation timeCopied from audit value fields
Vendor.CertificateCNtls.client.x509.subject.common_name[]Certificate subject common nameArray populated from certificate field
url.full (indirect)url.domainURL domain componentExtracted from url.full using parseUrl() then renamed from url.host with lowercase transformation
Vendor.Protocol, Vendor.Host, Vendor.URLurl.fullComplete URL stringFormatted from protocol, host, and URL fields using format()
Vendor.URLurl.originalOriginal URL pathCopied from field
url.full (indirect)url.pathURL path componentExtracted from url.full using parseUrl()
url.full (indirect)url.queryURL query stringExtracted from url.full using parseUrl()
url.full (indirect)url.schemeURL scheme componentExtracted from url.full using parseUrl()
Vendor.User, Vendor.NameID, Vendor.Username, Vendor.suser (indirect)user.domainUser domain extracted from email addressExtracted from username via regex when email format detected
Vendor.User, Vendor.NameID, Vendor.Username, Vendor.suser, Vendor.UserIDuser.emailUser email addressCopied from unified username field when it contains @ symbol
Vendor.ModifiedBy, user.email (indirect)user.idUser identifierCopied from field using coalesce
Vendor.User, Vendor.NameID, Vendor.Username, Vendor.suseruser.nameUsernameExtracted from unified username field; if email, extracted via regex before @; otherwise copied directly
Vendor.AuditNewValue.email, Vendor.AuditOldValue.emailuser.target.emailTarget user email addressCopied from audit value fields
Vendor.AuditNewValue.id, Vendor.AuditOldValue.iduser.target.idTarget user identifierCopied from audit value fields
Vendor.AuditNewValue.displayName, Vendor.AuditOldValue.displayNameuser.target.nameTarget user display nameCopied from audit value fields
Vendor.AuditNewValue.roles[], Vendor.AuditOldValue.roles[]user.target.roles[]Target user rolesArray populated from audit role fields using objectArray:eval
Vendor.UserAgentuser_agent.originalOriginal user agent stringCopied from field