From 706e4930a6411eda901c9cb5fd954dae37cd07fa Mon Sep 17 00:00:00 2001 From: vakohl <97222872+vakohl@users.noreply.github.com> Date: Thu, 4 Apr 2024 15:56:27 +0530 Subject: [PATCH] adding templates --- ASIM/dev/ASimTester/ASimTester.csv | 14 +- .../AuditEvent_ProductName_MappingSheet.csv | 134 +++++++++++++ ...uthentication_ProductName_MappingSheet.csv | 136 +++++++++++++ ...ication_SampleProductName_MappingSheet.csv | 2 - .../DhcpEvent_ProductName_MappingSheet.csv | 105 +++++++++++ .../Dns_ProductName_MappingSheet.csv | 152 +++++++++++++++ .../FileEvent_ProductName_MappingSheet.csv | 138 ++++++++++++++ ...etworkSession_ProductName_MappingSheet.csv | 163 ++++++++++++++++ .../ProcessEvent_ProductName_MappingSheet.csv | 150 +++++++++++++++ ...RegistryEvent_ProductName_MappingSheet.csv | 70 +++++++ ...serManagement_ProductName_MappingSheet.csv | 117 ++++++++++++ .../WebSession_ProductName_MappingSheet.csv | 178 ++++++++++++++++++ 12 files changed, 1350 insertions(+), 9 deletions(-) create mode 100644 Parsers/ASimAuditEvent/Field Mappings/AuditEvent_ProductName_MappingSheet.csv create mode 100644 Parsers/ASimAuthentication/Field Mappings/Authentication_ProductName_MappingSheet.csv delete mode 100644 Parsers/ASimAuthentication/Field Mappings/Authentication_SampleProductName_MappingSheet.csv create mode 100644 Parsers/ASimDhcpEvent/Field Mappings/DhcpEvent_ProductName_MappingSheet.csv create mode 100644 Parsers/ASimDns/Field Mappings/Dns_ProductName_MappingSheet.csv create mode 100644 Parsers/ASimFileEvent/Field Mappings/FileEvent_ProductName_MappingSheet.csv create mode 100644 Parsers/ASimNetworkSession/Field Mappings/NetworkSession_ProductName_MappingSheet.csv create mode 100644 Parsers/ASimProcessEvent/Field Mappings/ProcessEvent_ProductName_MappingSheet.csv create mode 100644 Parsers/ASimRegistryEvent/Field Mappings/RegistryEvent_ProductName_MappingSheet.csv create mode 100644 Parsers/ASimUserManagement/Field Mappings/UserManagement_ProductName_MappingSheet.csv create mode 100644 Parsers/ASimWebSession/Field Mappings/WebSession_ProductName_MappingSheet.csv diff --git a/ASIM/dev/ASimTester/ASimTester.csv b/ASIM/dev/ASimTester/ASimTester.csv index 78dda8ba14..3dd4b0c42c 100644 --- a/ASIM/dev/ASimTester/ASimTester.csv +++ b/ASIM/dev/ASimTester/ASimTester.csv @@ -7,6 +7,7 @@ ActingAppName,string,Optional,AuditEvent,,, ActingAppName,string,Optional,Authentication,,, ActingAppName,string,Optional,FileEvent,,, ActingAppName,string,Optional,UserManagement,,, +ActingAppName,string,Optional,UserManagement,,, ActingAppType,string,Optional,AuditEvent,Enumerated,Process|Service|Resource|URL|SaaS application|CSP|Other, ActingAppType,string,Optional,Authentication,Enumerated,Process|Service|Resource|URL|SaaS application|CSP|Other, ActingAppType,string,Optional,FileEvent,Enumerated,Process|Service|Resource|URL|SaaS application|CSP|Other, @@ -43,7 +44,6 @@ ActingProcessSHA1,string,Optional,ProcessEvent,SHA1,, ActingProcessSHA256,string,Optional,ProcessEvent,SHA256,, ActingProcessSHA512,string,Optional,ProcessEvent,SHA521,, ActingProcessTokenElevation,string,Optional,ProcessEvent,,, -ActingAppName,string,Optional,UserManagement,,, ActorOriginalUserType,string,Optional,UserManagement,,, ActorOriginalUserType,string,Optional,AuditEvent,,, ActorOriginalUserType,string,Optional,Authentication,,, @@ -783,9 +783,9 @@ NewValue,string,Recommended,AuditEvent,,, Object,string,Recommended,AuditEvent,,, ObjectId,string,Recommended,AuditEvent,,, ObjectType,string,Related,AuditEvent,Enumerated,Configuration Atom|Policy Rule|Event Log|Scheduled Task|Service|Directory Service Object|Other, -OriginalObjectType,string,Optional,AuditEvent,,, OldValue,string,Optional,AuditEvent,,, Operation,string,Mandatory,AuditEvent,,, +OriginalObjectType,string,Optional,AuditEvent,,, OuterVlanId,string,Alias,NetworkSession,,,DstVlanId OuterVlanId,string,Alias,WebSession,,,DstVlanId ParentProcessCreationTime,datetime,Optional,ProcessEvent,,, @@ -1025,8 +1025,8 @@ SrcOriginalRiskLevel,string,Optional,AuditEvent,,, SrcOriginalRiskLevel,string,Optional,Authentication,,, SrcOriginalRiskLevel,string,Optional,Dns,,, SrcOriginalRiskLevel,string,Optional,DhcpEvent,,, -SrcOriginalUserType,string,Optional,DhcpEvent,,, SrcOriginalRiskLevel,string,Optional,UserManagement,,, +SrcOriginalUserType,string,Optional,DhcpEvent,,, SrcOriginalUserType,string,Optional,Dns,,, SrcOriginalUserType,string,Optional,NetworkSession,,, SrcOriginalUserType,string,Optional,WebSession,,, @@ -1097,9 +1097,6 @@ TargetAppName,string,Optional,FileEvent,,, TargetAppType,string,Conditional,AuditEvent,Enumerated,Process|Service|Resource|URL|SaaS application|Other,TargetAppName TargetAppType,string,Conditional,Authentication,Enumerated,Process|Service|Resource|URL|SaaS application|Other,TargetAppName TargetAppType,string,Conditional,FileEvent,Enumerated,Process|Service|Resource|URL|SaaS application|Other,TargetAppName -TargetOriginalAppType,string,Optional,AuditEvent,,, -TargetOriginalAppType,string,Optional,FileEvent,,, -TargetOriginalAppType,string,Optional,Authentication,,, TargetDescription,string,Optional,AuditEvent,,, TargetDescription,string,Optional,Authentication,,, TargetDeviceType,string,Optional,AuditEvent,Enumerated,Computer|Mobile Device|IOT Device|Other, @@ -1146,6 +1143,9 @@ TargetHostname,string,Recommended,AuditEvent,,, TargetHostname,string,Recommended,Authentication,Hostname,, TargetIpAddr,string,Optional,Authentication,IP Address,, TargetIpAddr,string,Recommended,AuditEvent,IP Address,, +TargetOriginalAppType,string,Optional,AuditEvent,,, +TargetOriginalAppType,string,Optional,FileEvent,,, +TargetOriginalAppType,string,Optional,Authentication,,, TargetOriginalRiskLevel,string,Optional,AuditEvent,,, TargetOriginalRiskLevel,string,Optional,Authentication,,, TargetOriginalUserType,string,Optional,Authentication,,, @@ -1189,7 +1189,6 @@ TargetUserAadId,string,Optional,ProcessEvent,,, TargetUserId,string,Optional,Authentication,,, TargetUserId,string,Optional,UserManagement,,, TargetUserId,string,Recommended,ProcessEvent,,, -TargetUserUid,string,Optional,UserManagement,,, TargetUserIdType,string,Conditional,Authentication,Enumerated,SID|UID|AADID|OktaId|AWSId|PUID|SalesforceId|VectraUserId|MD4IoTid|GWorkspaceProfileID|Other,TargetUserId TargetUserIdType,string,Conditional,ProcessEvent,Enumerated,SID|UID|AADID|OktaId|AWSId|PUID|SalesforceId|VectraUserId|MD4IoTid|Other,TargetUserId TargetUserIdType,string,Conditional,UserManagement,Enumerated,SID|UID|AADID|OktaId|AWSId|PUID|SalesforceId|VectraUserId|MD4IoTid|Other,TargetUserId @@ -1210,6 +1209,7 @@ TargetUserSid,string,Optional,ProcessEvent,,, TargetUserType,string,Optional,Authentication,,Regular|Guest|Machine|Admin|System|Application|Service|Other, TargetUserType,string,Optional,ProcessEvent,Enumerated,Regular|Guest|Machine|Admin|System|Application|Service|Other, TargetUserType,string,Optional,UserManagement,Enumerated,Regular|Machine|Admin|System|Application|Service Principal|Other, +TargetUserUid,string,Optional,UserManagement,,, TargetUserUpn,string,Optional,ProcessEvent,,, TcpFlagsAck,bool,Optional,NetworkSession,,, TcpFlagsFin,bool,Optional,NetworkSession,,, diff --git a/Parsers/ASimAuditEvent/Field Mappings/AuditEvent_ProductName_MappingSheet.csv b/Parsers/ASimAuditEvent/Field Mappings/AuditEvent_ProductName_MappingSheet.csv new file mode 100644 index 0000000000..59aecb56e6 --- /dev/null +++ b/Parsers/ASimAuditEvent/Field Mappings/AuditEvent_ProductName_MappingSheet.csv @@ -0,0 +1,134 @@ +ASIMFieldName, ASIMFieldType, ProductFieldName, ProductFieldType, ProductFieldDescription, ProductSampleValue, Logic +ActingAppId,string,,,,,direct mapping +ActingAppName,string,,,,,direct mapping +ActingAppType,string,,,,,direct mapping +ActingOriginalAppType,string,,,,,direct mapping +ActorOriginalUserType,string,,,,,direct mapping +ActorScope,string,,,,,direct mapping +ActorScopeId,string,,,,,direct mapping +ActorSessionId,string,,,,,direct mapping +ActorUserAadId,string,,,,,direct mapping +ActorUserId,string,,,,,direct mapping +ActorUserIdType,string,,,,,direct mapping +ActorUsername,string,,,,,direct mapping +ActorUsernameType,string,,,,,direct mapping +ActorUserSid,string,,,,,direct mapping +ActorUserType,string,,,,,direct mapping +AdditionalFields,dynamic,,,,,direct mapping +Application,string,,,,,direct mapping +Dst,string,,,,,direct mapping +Dvc,string,,,,,direct mapping +DvcAction,string,,,,,direct mapping +DvcDescription,string,,,,,direct mapping +DvcDomain,string,,,,,direct mapping +DvcDomainType,string,,,,,direct mapping +DvcFQDN,string,,,,,direct mapping +DvcHostname,string,,,,,direct mapping +DvcId,string,,,,,direct mapping +DvcIdType,string,,,,,direct mapping +DvcInterface,string,,,,,direct mapping +DvcIpAddr,string,,,,,direct mapping +DvcMacAddr,string,,,,,direct mapping +DvcOriginalAction,string,,,,,direct mapping +DvcOs,string,,,,,direct mapping +DvcOsVersion,string,,,,,direct mapping +DvcScope,string,,,,,direct mapping +DvcScopeId,string,,,,,direct mapping +DvcZone,string,,,,,direct mapping +EventCount,int,,,,,direct mapping +EventEndTime,datetime,,,,,direct mapping +EventMessage,string,,,,,direct mapping +EventOriginalResultDetails,string,,,,,direct mapping +EventOriginalSeverity,string,,,,,direct mapping +EventOriginalSubType,string,,,,,direct mapping +EventOriginalType,string,,,,,direct mapping +EventOriginalUid,string,,,,,direct mapping +EventOwner,string,,,,,direct mapping +EventProduct,string,,,,,direct mapping +EventProductVersion,string,,,,,direct mapping +EventReportUrl,string,,,,,direct mapping +EventResult,string,,,,,direct mapping +EventResultDetails,string,,,,,direct mapping +EventSchema,string,,,,,direct mapping +EventSchemaVersion,string,,,,,direct mapping +EventSeverity,string,,,,,direct mapping +EventStartTime,datetime,,,,,direct mapping +EventSubType,string,,,,,direct mapping +EventType,string,,,,,direct mapping +EventUid,string,,,,,direct mapping +EventVendor,string,,,,,direct mapping +HttpUserAgent,string,,,,,direct mapping +IpAddr,string,,,,,direct mapping +NewValue,string,,,,,direct mapping +Object,string,,,,,direct mapping +ObjectId,string,,,,,direct mapping +ObjectType,string,,,,,direct mapping +OldValue,string,,,,,direct mapping +Operation,string,,,,,direct mapping +OriginalObjectType,string,,,,,direct mapping +Process,string,,,,,direct mapping +Rule,string,,,,,direct mapping +RuleName,string,,,,,direct mapping +RuleNumber,int,,,,,direct mapping +Src,string,,,,,direct mapping +SrcDescription,string,,,,,direct mapping +SrcDeviceType,string,,,,,direct mapping +SrcDomain,string,,,,,direct mapping +SrcDomainType,string,,,,,direct mapping +SrcDvcId,string,,,,,direct mapping +SrcDvcIdType,string,,,,,direct mapping +SrcDvcScope,string,,,,,direct mapping +SrcDvcScopeId,string,,,,,direct mapping +SrcFQDN,string,,,,,direct mapping +SrcGeoCity,string,,,,,direct mapping +SrcGeoCountry,string,,,,,direct mapping +SrcGeoLatitude,real,,,,,direct mapping +SrcGeoLongitude,real,,,,,direct mapping +SrcGeoRegion,string,,,,,direct mapping +SrcHostname,string,,,,,direct mapping +SrcIpAddr,string,,,,,direct mapping +SrcOriginalRiskLevel,string,,,,,direct mapping +SrcPortNumber,int,,,,,direct mapping +SrcRiskLevel,int,,,,,direct mapping +TargetAppId,string,,,,,direct mapping +TargetAppName,string,,,,,direct mapping +TargetAppType,string,,,,,direct mapping +TargetDescription,string,,,,,direct mapping +TargetDeviceType,string,,,,,direct mapping +TargetDomain,string,,,,,direct mapping +TargetDomainType,string,,,,,direct mapping +TargetDvcId,string,,,,,direct mapping +TargetDvcIdType,string,,,,,direct mapping +TargetDvcOs,string,,,,,direct mapping +TargetDvcScope,string,,,,,direct mapping +TargetDvcScopeId,string,,,,,direct mapping +TargetFQDN,string,,,,,direct mapping +TargetGeoCity,string,,,,,direct mapping +TargetGeoCountry,string,,,,,direct mapping +TargetGeoLatitude,real,,,,,direct mapping +TargetGeoLongitude,real,,,,,direct mapping +TargetGeoRegion,string,,,,,direct mapping +TargetHostname,string,,,,,direct mapping +TargetIpAddr,string,,,,,direct mapping +TargetOriginalAppType,string,,,,,direct mapping +TargetOriginalRiskLevel,string,,,,,direct mapping +TargetPortNumber,int,,,,,direct mapping +TargetRiskLevel,int,,,,,direct mapping +TargetUrl,string,,,,,direct mapping +ThreatCategory,string,,,,,direct mapping +ThreatConfidence,int,,,,,direct mapping +ThreatField,string,,,,,direct mapping +ThreatFirstReportedTime,datetime,,,,,direct mapping +ThreatId,string,,,,,direct mapping +ThreatIpAddr,string,,,,,direct mapping +ThreatIsActive,bool,,,,,direct mapping +ThreatLastReportedTime,datetime,,,,,direct mapping +ThreatName,string,,,,,direct mapping +ThreatOriginalConfidence,string,,,,,direct mapping +ThreatOriginalRiskLevel,string,,,,,direct mapping +ThreatRiskLevel,int,,,,,direct mapping +TimeGenerated,datetime,,,,,direct mapping +Type,string,,,,,direct mapping +User,string,,,,,direct mapping +Value,string,,,,,direct mapping +ValueType,string,,,,,direct mapping diff --git a/Parsers/ASimAuthentication/Field Mappings/Authentication_ProductName_MappingSheet.csv b/Parsers/ASimAuthentication/Field Mappings/Authentication_ProductName_MappingSheet.csv new file mode 100644 index 0000000000..f0c657850a --- /dev/null +++ b/Parsers/ASimAuthentication/Field Mappings/Authentication_ProductName_MappingSheet.csv @@ -0,0 +1,136 @@ +ASIMFieldName, ASIMFieldType, ProductFieldName, ProductFieldType, ProductFieldDescription, ProductSampleValue, Logic +ActingAppId,string,,,,,direct mapping +ActingAppName,string,,,,,direct mapping +ActingAppType,string,,,,,direct mapping +ActingOriginalAppType,string,,,,,direct mapping +ActorOriginalUserType,string,,,,,direct mapping +ActorScope,string,,,,,direct mapping +ActorScopeId,string,,,,,direct mapping +ActorSessionId,string,,,,,direct mapping +ActorUserId,string,,,,,direct mapping +ActorUserIdType,string,,,,,direct mapping +ActorUsername,string,,,,,direct mapping +ActorUsernameType,string,,,,,direct mapping +ActorUserType,string,,,,,direct mapping +AdditionalFields,dynamic,,,,,direct mapping +Application,string,,,,,direct mapping +Dst,string,,,,,direct mapping +Dvc,string,,,,,direct mapping +DvcAction,string,,,,,direct mapping +DvcDescription,string,,,,,direct mapping +DvcDomain,string,,,,,direct mapping +DvcDomainType,string,,,,,direct mapping +DvcFQDN,string,,,,,direct mapping +DvcHostname,string,,,,,direct mapping +DvcId,string,,,,,direct mapping +DvcIdType,string,,,,,direct mapping +DvcInterface,string,,,,,direct mapping +DvcIpAddr,string,,,,,direct mapping +DvcMacAddr,string,,,,,direct mapping +DvcOriginalAction,string,,,,,direct mapping +DvcOs,string,,,,,direct mapping +DvcOsVersion,string,,,,,direct mapping +DvcScope,string,,,,,direct mapping +DvcScopeId,string,,,,,direct mapping +DvcZone,string,,,,,direct mapping +EventCount,int,,,,,direct mapping +EventEndTime,datetime,,,,,direct mapping +EventMessage,string,,,,,direct mapping +EventOriginalResultDetails,string,,,,,direct mapping +EventOriginalSeverity,string,,,,,direct mapping +EventOriginalSubType,string,,,,,direct mapping +EventOriginalType,string,,,,,direct mapping +EventOriginalUid,string,,,,,direct mapping +EventOwner,string,,,,,direct mapping +EventProduct,string,,,,,direct mapping +EventProductVersion,string,,,,,direct mapping +EventReportUrl,string,,,,,direct mapping +EventResult,string,,,,,direct mapping +EventResultDetails,string,,,,,direct mapping +EventSchema,string,,,,,direct mapping +EventSchemaVersion,string,,,,,direct mapping +EventSeverity,string,,,,,direct mapping +EventStartTime,datetime,,,,,direct mapping +EventSubType,string,,,,,direct mapping +EventType,string,,,,,direct mapping +EventUid,string,,,,,direct mapping +EventVendor,string,,,,,direct mapping +HttpUserAgent,string,,,,,direct mapping +IpAddr,string,,,,,direct mapping +LogonMethod,string,,,,,direct mapping +LogonProtocol,string,,,,,direct mapping +LogonTarget,string,,,,,direct mapping +Rule,string,,,,,direct mapping +RuleName,string,,,,,direct mapping +RuleNumber,int,,,,,direct mapping +Src,string,,,,,direct mapping +SrcDescription,string,,,,,direct mapping +SrcDeviceType,string,,,,,direct mapping +SrcDomain,string,,,,,direct mapping +SrcDomainType,string,,,,,direct mapping +SrcDvcId,string,,,,,direct mapping +SrcDvcIdType,string,,,,,direct mapping +SrcDvcOs,string,,,,,direct mapping +SrcDvcScope,string,,,,,direct mapping +SrcDvcScopeId,string,,,,,direct mapping +SrcFQDN,string,,,,,direct mapping +SrcGeoCity,string,,,,,direct mapping +SrcGeoCountry,string,,,,,direct mapping +SrcGeoLatitude,real,,,,,direct mapping +SrcGeoLongitude,real,,,,,direct mapping +SrcGeoRegion,string,,,,,direct mapping +SrcHostname,string,,,,,direct mapping +SrcIpAddr,string,,,,,direct mapping +SrcIsp,string,,,,,direct mapping +SrcOriginalRiskLevel,string,,,,,direct mapping +SrcPortNumber,int,,,,,direct mapping +SrcRiskLevel,int,,,,,direct mapping +TargetAppId,string,,,,,direct mapping +TargetAppName,string,,,,,direct mapping +TargetAppType,string,,,,,direct mapping +TargetDescription,string,,,,,direct mapping +TargetDeviceType,string,,,,,direct mapping +TargetDomain,string,,,,,direct mapping +TargetDomainType,string,,,,,direct mapping +TargetDvcId,string,,,,,direct mapping +TargetDvcIdType,string,,,,,direct mapping +TargetDvcOs,string,,,,,direct mapping +TargetDvcScope,string,,,,,direct mapping +TargetDvcScopeId,string,,,,,direct mapping +TargetFQDN,string,,,,,direct mapping +TargetGeoCity,string,,,,,direct mapping +TargetGeoCountry,string,,,,,direct mapping +TargetGeoLatitude,real,,,,,direct mapping +TargetGeoLongitude,real,,,,,direct mapping +TargetGeoRegion,string,,,,,direct mapping +TargetHostname,string,,,,,direct mapping +TargetIpAddr,string,,,,,direct mapping +TargetOriginalAppType,string,,,,,direct mapping +TargetOriginalRiskLevel,string,,,,,direct mapping +TargetOriginalUserType,string,,,,,direct mapping +TargetPortNumber,int,,,,,direct mapping +TargetRiskLevel,int,,,,,direct mapping +TargetSessionId,string,,,,,direct mapping +TargetUrl,string,,,,,direct mapping +TargetUserId,string,,,,,direct mapping +TargetUserIdType,string,,,,,direct mapping +TargetUsername,string,,,,,direct mapping +TargetUsernameType,string,,,,,direct mapping +TargetUserScope,string,,,,,direct mapping +TargetUserScopeId,string,,,,,direct mapping +TargetUserType,string,,,,,direct mapping +ThreatCategory,string,,,,,direct mapping +ThreatConfidence,int,,,,,direct mapping +ThreatField,string,,,,,direct mapping +ThreatFirstReportedTime,datetime,,,,,direct mapping +ThreatId,string,,,,,direct mapping +ThreatIpAddr,string,,,,,direct mapping +ThreatIsActive,bool,,,,,direct mapping +ThreatLastReportedTime,datetime,,,,,direct mapping +ThreatName,string,,,,,direct mapping +ThreatOriginalConfidence,string,,,,,direct mapping +ThreatOriginalRiskLevel,string,,,,,direct mapping +ThreatRiskLevel,int,,,,,direct mapping +TimeGenerated,datetime,,,,,direct mapping +Type,string,,,,,direct mapping +User,string,,,,,direct mapping diff --git a/Parsers/ASimAuthentication/Field Mappings/Authentication_SampleProductName_MappingSheet.csv b/Parsers/ASimAuthentication/Field Mappings/Authentication_SampleProductName_MappingSheet.csv deleted file mode 100644 index 737351be86..0000000000 --- a/Parsers/ASimAuthentication/Field Mappings/Authentication_SampleProductName_MappingSheet.csv +++ /dev/null @@ -1,2 +0,0 @@ -ProductFieldName, ProductFieldDescription, ProductFieldType, ProductSampleValue, ASIMFieldName, ASIMFieldType, Comment -user_email, user email address, string, rahul.sharma@contoso.com, TargetUsername, string, diff --git a/Parsers/ASimDhcpEvent/Field Mappings/DhcpEvent_ProductName_MappingSheet.csv b/Parsers/ASimDhcpEvent/Field Mappings/DhcpEvent_ProductName_MappingSheet.csv new file mode 100644 index 0000000000..833e136a2e --- /dev/null +++ b/Parsers/ASimDhcpEvent/Field Mappings/DhcpEvent_ProductName_MappingSheet.csv @@ -0,0 +1,105 @@ +ASIMFieldName, ASIMFieldType, ProductFieldName, ProductFieldType, ProductFieldDescription, ProductSampleValue, Logic +AdditionalFields,dynamic,,,,,direct mapping +DhcpCircuitId,string,,,,,direct mapping +DhcpLeaseDuration,int,,,,,direct mapping +DhcpSessionDuration,int,,,,,direct mapping +DhcpSessionId,string,,,,,direct mapping +DhcpSrcDHCId,string,,,,,direct mapping +DhcpSubscriberId,string,,,,,direct mapping +DhcpUserClass,string,,,,,direct mapping +DhcpUserClassId,string,,,,,direct mapping +DhcpVendorClass,string,,,,,direct mapping +DhcpVendorClassId,string,,,,,direct mapping +Dst,string,,,,,direct mapping +Duration,int,,,,,direct mapping +DvcAction,string,,,,,direct mapping +DvcDescription,string,,,,,direct mapping +DvcDomain,string,,,,,direct mapping +DvcDomainType,string,,,,,direct mapping +DvcFQDN,string,,,,,direct mapping +DvcHostname,string,,,,,direct mapping +DvcId,string,,,,,direct mapping +DvcIdType,string,,,,,direct mapping +DvcInterface,string,,,,,direct mapping +DvcIpAddr,string,,,,,direct mapping +DvcMacAddr,string,,,,,direct mapping +DvcOriginalAction,string,,,,,direct mapping +DvcOs,string,,,,,direct mapping +DvcOsVersion,string,,,,,direct mapping +DvcScope,string,,,,,direct mapping +DvcScopeId,string,,,,,direct mapping +DvcZone,string,,,,,direct mapping +EventCount,int,,,,,direct mapping +EventEndTime,datetime,,,,,direct mapping +EventMessage,string,,,,,direct mapping +EventOriginalResultDetails,string,,,,,direct mapping +EventOriginalSeverity,string,,,,,direct mapping +EventOriginalSubType,string,,,,,direct mapping +EventOriginalType,string,,,,,direct mapping +EventOriginalUid,string,,,,,direct mapping +EventOwner,string,,,,,direct mapping +EventProduct,string,,,,,direct mapping +EventProductVersion,string,,,,,direct mapping +EventReportUrl,string,,,,,direct mapping +EventResult,string,,,,,direct mapping +EventResultDetails,string,,,,,direct mapping +EventSchema,string,,,,,direct mapping +EventSchemaVersion,string,,,,,direct mapping +EventSeverity,string,,,,,direct mapping +EventStartTime,datetime,,,,,direct mapping +EventSubType,string,,,,,direct mapping +EventType,string,,,,,direct mapping +EventUid,string,,,,,direct mapping +EventVendor,string,,,,,direct mapping +Hostname,string,,,,,direct mapping +IpAddr,string,,,,,direct mapping +RequestedIpAddr,string,,,,,direct mapping +Rule,string,,,,,direct mapping +RuleName,string,,,,,direct mapping +RuleNumber,int,,,,,direct mapping +SessionId,string,,,,,direct mapping +Src,string,,,,,direct mapping +SrcDescription,string,,,,,direct mapping +SrcDeviceType,string,,,,,direct mapping +SrcDomain,string,,,,,direct mapping +SrcDomainType,string,,,,,direct mapping +SrcDvcId,string,,,,,direct mapping +SrcDvcIdType,string,,,,,direct mapping +SrcDvcScope,string,,,,,direct mapping +SrcDvcScopeId,string,,,,,direct mapping +SrcFQDN,string,,,,,direct mapping +SrcGeoCity,string,,,,,direct mapping +SrcGeoCountry,string,,,,,direct mapping +SrcGeoLatitude,real,,,,,direct mapping +SrcGeoLongitude,real,,,,,direct mapping +SrcGeoRegion,string,,,,,direct mapping +SrcHostname,string,,,,,direct mapping +SrcIpAddr,string,,,,,direct mapping +SrcMacAddr,string,,,,,direct mapping +SrcOriginalRiskLevel,string,,,,,direct mapping +SrcOriginalUserType,string,,,,,direct mapping +SrcPortNumber,int,,,,,direct mapping +SrcRiskLevel,int,,,,,direct mapping +SrcUserId,string,,,,,direct mapping +SrcUserIdType,string,,,,,direct mapping +SrcUsername,string,,,,,direct mapping +SrcUsernameType,string,,,,,direct mapping +SrcUserScope,string,,,,,direct mapping +SrcUserScopeId,string,,,,,direct mapping +SrcUserSessionId,string,,,,,direct mapping +SrcUserType,string,,,,,direct mapping +SrcUserUid,string,,,,,direct mapping +ThreatCategory,string,,,,,direct mapping +ThreatConfidence,int,,,,,direct mapping +ThreatField,string,,,,,direct mapping +ThreatFirstReportedTime,datetime,,,,,direct mapping +ThreatId,string,,,,,direct mapping +ThreatIsActive,bool,,,,,direct mapping +ThreatLastReportedTime,datetime,,,,,direct mapping +ThreatName,string,,,,,direct mapping +ThreatOriginalConfidence,string,,,,,direct mapping +ThreatOriginalRiskLevel,string,,,,,direct mapping +ThreatRiskLevel,int,,,,,direct mapping +TimeGenerated,datetime,,,,,direct mapping +Type,string,,,,,direct mapping +Username,string,,,,,direct mapping diff --git a/Parsers/ASimDns/Field Mappings/Dns_ProductName_MappingSheet.csv b/Parsers/ASimDns/Field Mappings/Dns_ProductName_MappingSheet.csv new file mode 100644 index 0000000000..4a67c69b9e --- /dev/null +++ b/Parsers/ASimDns/Field Mappings/Dns_ProductName_MappingSheet.csv @@ -0,0 +1,152 @@ +ASIMFieldName, ASIMFieldType, ProductFieldName, ProductFieldType, ProductFieldDescription, ProductSampleValue, Logic +AdditionalFields,dynamic,,,,,direct mapping +DnsFlags,string,,,,,direct mapping +DnsFlagsAuthenticated,bool,,,,,direct mapping +DnsFlagsAuthoritative,bool,,,,,direct mapping +DnsFlagsCheckingDisabled,bool,,,,,direct mapping +DnsFlagsRecursionAvailable,bool,,,,,direct mapping +DnsFlagsRecursionDesired,bool,,,,,direct mapping +DnsFlagsTruncated,bool,,,,,direct mapping +DnsFlagsZ,bool,,,,,direct mapping +DnsNetworkDuration,int,,,,,direct mapping +DnsQuery,string,,,,,direct mapping +DnsQueryClass,int,,,,,direct mapping +DnsQueryClassName,string,,,,,direct mapping +DnsQueryType,int,,,,,direct mapping +DnsQueryTypeName,string,,,,,direct mapping +DnsResponseCode,int,,,,,direct mapping +DnsResponseCodeName,string,,,,,direct mapping +DnsResponseIpCity,string,,,,,direct mapping +DnsResponseIpCountry,string,,,,,direct mapping +DnsResponseIpLatitude,real,,,,,direct mapping +DnsResponseIpLongitude,real,,,,,direct mapping +DnsResponseIpRegion,string,,,,,direct mapping +DnsResponseName,string,,,,,direct mapping +DnsSessionId,string,,,,,direct mapping +Domain,string,,,,,direct mapping +DomainCategory,string,,,,,direct mapping +Dst,string,,,,,direct mapping +DstDescription,string,,,,,direct mapping +DstDeviceType,string,,,,,direct mapping +DstDomain,string,,,,,direct mapping +DstDomainType,string,,,,,direct mapping +DstDvcId,string,,,,,direct mapping +DstDvcIdType,string,,,,,direct mapping +DstDvcScope,string,,,,,direct mapping +DstDvcScopeId,string,,,,,direct mapping +DstFQDN,string,,,,,direct mapping +DstGeoCity,string,,,,,direct mapping +DstGeoCountry,string,,,,,direct mapping +DstGeoLatitude,real,,,,,direct mapping +DstGeoLongitude,real,,,,,direct mapping +DstGeoRegion,string,,,,,direct mapping +DstHostname,string,,,,,direct mapping +DstIpAddr,string,,,,,direct mapping +DstOriginalRiskLevel,string,,,,,direct mapping +DstPortNumber,int,,,,,direct mapping +DstRiskLevel,int,,,,,direct mapping +Duration,int,,,,,direct mapping +Dvc,string,,,,,direct mapping +DvcAction,string,,,,,direct mapping +DvcDescription,string,,,,,direct mapping +DvcDomain,string,,,,,direct mapping +DvcDomainType,string,,,,,direct mapping +DvcFQDN,string,,,,,direct mapping +DvcHostname,string,,,,,direct mapping +DvcId,string,,,,,direct mapping +DvcIdType,string,,,,,direct mapping +DvcInterface,string,,,,,direct mapping +DvcIpAddr,string,,,,,direct mapping +DvcMacAddr,string,,,,,direct mapping +DvcOriginalAction,string,,,,,direct mapping +DvcOs,string,,,,,direct mapping +DvcOsVersion,string,,,,,direct mapping +DvcScope,string,,,,,direct mapping +DvcScopeId,string,,,,,direct mapping +DvcZone,string,,,,,direct mapping +EventCount,int,,,,,direct mapping +EventEndTime,datetime,,,,,direct mapping +EventMessage,string,,,,,direct mapping +EventOriginalResultDetails,string,,,,,direct mapping +EventOriginalSeverity,string,,,,,direct mapping +EventOriginalSubType,string,,,,,direct mapping +EventOriginalType,string,,,,,direct mapping +EventOriginalUid,string,,,,,direct mapping +EventOwner,string,,,,,direct mapping +EventProduct,string,,,,,direct mapping +EventProductVersion,string,,,,,direct mapping +EventReportUrl,string,,,,,direct mapping +EventResult,string,,,,,direct mapping +EventResultDetails,string,,,,,direct mapping +EventSchema,string,,,,,direct mapping +EventSchemaVersion,string,,,,,direct mapping +EventSeverity,string,,,,,direct mapping +EventStartTime,datetime,,,,,direct mapping +EventSubType,string,,,,,direct mapping +EventType,string,,,,,direct mapping +EventUid,string,,,,,direct mapping +EventVendor,string,,,,,direct mapping +Hostname,string,,,,,direct mapping +IpAddr,string,,,,,direct mapping +NetworkProtocol,string,,,,,direct mapping +NetworkProtocolVersion,string,,,,,direct mapping +Process,string,,,,,direct mapping +Rule,string,,,,,direct mapping +RuleName,string,,,,,direct mapping +RuleNumber,int,,,,,direct mapping +SessionId,string,,,,,direct mapping +Src,string,,,,,direct mapping +SrcDescription,string,,,,,direct mapping +SrcDeviceType,string,,,,,direct mapping +SrcDomain,string,,,,,direct mapping +SrcDomainType,string,,,,,direct mapping +SrcDvcId,string,,,,,direct mapping +SrcDvcIdType,string,,,,,direct mapping +SrcDvcScope,string,,,,,direct mapping +SrcDvcScopeId,string,,,,,direct mapping +SrcFQDN,string,,,,,direct mapping +SrcGeoCity,string,,,,,direct mapping +SrcGeoCountry,string,,,,,direct mapping +SrcGeoLatitude,real,,,,,direct mapping +SrcGeoLongitude,real,,,,,direct mapping +SrcGeoRegion,string,,,,,direct mapping +SrcHostname,string,,,,,direct mapping +SrcIpAddr,string,,,,,direct mapping +SrcOriginalRiskLevel,string,,,,,direct mapping +SrcOriginalUserType,string,,,,,direct mapping +SrcPortNumber,int,,,,,direct mapping +SrcProcessGuid,string,,,,,direct mapping +SrcProcessId,string,,,,,direct mapping +SrcProcessName,string,,,,,direct mapping +SrcRiskLevel,int,,,,,direct mapping +SrcUserAadId,string,,,,,direct mapping +SrcUserAWSId,string,,,,,direct mapping +SrcUserId,string,,,,,direct mapping +SrcUserIdType,string,,,,,direct mapping +SrcUsername,string,,,,,direct mapping +SrcUsernameType,string,,,,,direct mapping +SrcUserOktaId,string,,,,,direct mapping +SrcUserScope,string,,,,,direct mapping +SrcUserScopeId,string,,,,,direct mapping +SrcUserSessionId,string,,,,,direct mapping +SrcUserSid,string,,,,,direct mapping +SrcUserType,string,,,,,direct mapping +SrcUserUid,string,,,,,direct mapping +TenantId,string,,,,,direct mapping +ThreatCategory,string,,,,,direct mapping +ThreatConfidence,int,,,,,direct mapping +ThreatField,string,,,,,direct mapping +ThreatFirstReportedTime,datetime,,,,,direct mapping +ThreatId,string,,,,,direct mapping +ThreatIpAddr,string,,,,,direct mapping +ThreatIsActive,bool,,,,,direct mapping +ThreatLastReportedTime,datetime,,,,,direct mapping +ThreatName,string,,,,,direct mapping +ThreatOriginalConfidence,string,,,,,direct mapping +ThreatOriginalRiskLevel,string,,,,,direct mapping +ThreatRiskLevel,int,,,,,direct mapping +TimeGenerated,datetime,,,,,direct mapping +TransactionIdHex,string,,,,,direct mapping +Type,string,,,,,direct mapping +UrlCategory,string,,,,,direct mapping +User,string,,,,,direct mapping diff --git a/Parsers/ASimFileEvent/Field Mappings/FileEvent_ProductName_MappingSheet.csv b/Parsers/ASimFileEvent/Field Mappings/FileEvent_ProductName_MappingSheet.csv new file mode 100644 index 0000000000..2670c8c6fc --- /dev/null +++ b/Parsers/ASimFileEvent/Field Mappings/FileEvent_ProductName_MappingSheet.csv @@ -0,0 +1,138 @@ +ASIMFieldName, ASIMFieldType, ProductFieldName, ProductFieldType, ProductFieldDescription, ProductSampleValue, Logic +ActingAppId,string,,,,,direct mapping +ActingAppName,string,,,,,direct mapping +ActingAppType,string,,,,,direct mapping +ActingProcessCommandLine,string,,,,,direct mapping +ActingProcessGuid,string,,,,,direct mapping +ActingProcessId,string,,,,,direct mapping +ActingProcessName,string,,,,,direct mapping +ActorOriginalUserType,string,,,,,direct mapping +ActorScope,string,,,,,direct mapping +ActorScopeId,string,,,,,direct mapping +ActorSessionId,string,,,,,direct mapping +ActorUpn,string,,,,,direct mapping +ActorUserAadId,string,,,,,direct mapping +ActorUserId,string,,,,,direct mapping +ActorUserIdType,string,,,,,direct mapping +ActorUsername,string,,,,,direct mapping +ActorUsernameType,string,,,,,direct mapping +ActorUserPuid,string,,,,,direct mapping +ActorUserSid,string,,,,,direct mapping +ActorUserType,string,,,,,direct mapping +AdditionalFields,dynamic,,,,,direct mapping +Application,string,,,,,direct mapping +DstDescription,string,,,,,direct mapping +Dvc,string,,,,,direct mapping +DvcAction,string,,,,,direct mapping +DvcDescription,string,,,,,direct mapping +DvcDomain,string,,,,,direct mapping +DvcDomainType,string,,,,,direct mapping +DvcFQDN,string,,,,,direct mapping +DvcHostname,string,,,,,direct mapping +DvcId,string,,,,,direct mapping +DvcIdType,string,,,,,direct mapping +DvcInterface,string,,,,,direct mapping +DvcIpAddr,string,,,,,direct mapping +DvcMacAddr,string,,,,,direct mapping +DvcOriginalAction,string,,,,,direct mapping +DvcOs,string,,,,,direct mapping +DvcOsVersion,string,,,,,direct mapping +DvcScope,string,,,,,direct mapping +DvcScopeId,string,,,,,direct mapping +DvcZone,string,,,,,direct mapping +EventCount,int,,,,,direct mapping +EventEndTime,datetime,,,,,direct mapping +EventMessage,string,,,,,direct mapping +EventOriginalResultDetails,string,,,,,direct mapping +EventOriginalSeverity,string,,,,,direct mapping +EventOriginalSubType,string,,,,,direct mapping +EventOriginalType,string,,,,,direct mapping +EventOriginalUid,string,,,,,direct mapping +EventOwner,string,,,,,direct mapping +EventProduct,string,,,,,direct mapping +EventProductVersion,string,,,,,direct mapping +EventReportUrl,string,,,,,direct mapping +EventResult,string,,,,,direct mapping +EventResultDetails,string,,,,,direct mapping +EventSchema,string,,,,,direct mapping +EventSchemaVersion,string,,,,,direct mapping +EventSeverity,string,,,,,direct mapping +EventStartTime,datetime,,,,,direct mapping +EventSubType,string,,,,,direct mapping +EventType,string,,,,,direct mapping +EventUid,string,,,,,direct mapping +EventVendor,string,,,,,direct mapping +FileName,string,,,,,direct mapping +FilePath,string,,,,,direct mapping +Hash,string,,,,,direct mapping +HashType,string,,,,,direct mapping +HttpUserAgent,string,,,,,direct mapping +IpAddr,string,,,,,direct mapping +NetworkApplicationProtocol,string,,,,,direct mapping +Process,string,,,,,direct mapping +Rule,string,,,,,direct mapping +RuleName,string,,,,,direct mapping +RuleNumber,int,,,,,direct mapping +Src,string,,,,,direct mapping +SrcDescription,string,,,,,direct mapping +SrcDeviceType,string,,,,,direct mapping +SrcDomain,string,,,,,direct mapping +SrcDomainType,string,,,,,direct mapping +SrcDvcId,string,,,,,direct mapping +SrcDvcIdType,string,,,,,direct mapping +SrcDvcScope,string,,,,,direct mapping +SrcDvcScopeId,string,,,,,direct mapping +SrcFileCreationTime,datetime,,,,,direct mapping +SrcFileDirectory,string,,,,,direct mapping +SrcFileExtension,string,,,,,direct mapping +SrcFileMD5,string,,,,,direct mapping +SrcFileMimeType,string,,,,,direct mapping +SrcFileName,string,,,,,direct mapping +SrcFilePath,string,,,,,direct mapping +SrcFilePathType,string,,,,,direct mapping +SrcFileSHA1,string,,,,,direct mapping +SrcFileSHA256,string,,,,,direct mapping +SrcFileSHA512,string,,,,,direct mapping +SrcFileSize,long,,,,,direct mapping +SrcFQDN,string,,,,,direct mapping +SrcGeoCity,string,,,,,direct mapping +SrcGeoCountry,string,,,,,direct mapping +SrcGeoLatitude,real,,,,,direct mapping +SrcGeoLongitude,real,,,,,direct mapping +SrcGeoRegion,string,,,,,direct mapping +SrcHostname,string,,,,,direct mapping +SrcIpAddr,string,,,,,direct mapping +SrcPortNumber,int,,,,,direct mapping +TargetAppId,string,,,,,direct mapping +TargetAppName,string,,,,,direct mapping +TargetAppType,string,,,,,direct mapping +TargetFileCreationTime,datetime,,,,,direct mapping +TargetFileDirectory,string,,,,,direct mapping +TargetFileExtension,string,,,,,direct mapping +TargetFileMD5,string,,,,,direct mapping +TargetFileMimeType,string,,,,,direct mapping +TargetFileName,string,,,,,direct mapping +TargetFilePath,string,,,,,direct mapping +TargetFilePathType,string,,,,,direct mapping +TargetFileSHA1,string,,,,,direct mapping +TargetFileSHA256,string,,,,,direct mapping +TargetFileSHA512,string,,,,,direct mapping +TargetFileSize,long,,,,,direct mapping +TargetOriginalAppType,string,,,,,direct mapping +TargetUrl,string,,,,,direct mapping +ThreatCategory,string,,,,,direct mapping +ThreatConfidence,int,,,,,direct mapping +ThreatField,string,,,,,direct mapping +ThreatFilePath,string,,,,,direct mapping +ThreatFirstReportedTime,datetime,,,,,direct mapping +ThreatId,string,,,,,direct mapping +ThreatIsActive,bool,,,,,direct mapping +ThreatLastReportedTime,datetime,,,,,direct mapping +ThreatName,string,,,,,direct mapping +ThreatOriginalConfidence,string,,,,,direct mapping +ThreatOriginalRiskLevel,string,,,,,direct mapping +ThreatRiskLevel,int,,,,,direct mapping +TimeGenerated,datetime,,,,,direct mapping +Type,string,,,,,direct mapping +Url,string,,,,,direct mapping +User,string,,,,,direct mapping diff --git a/Parsers/ASimNetworkSession/Field Mappings/NetworkSession_ProductName_MappingSheet.csv b/Parsers/ASimNetworkSession/Field Mappings/NetworkSession_ProductName_MappingSheet.csv new file mode 100644 index 0000000000..f4aa098128 --- /dev/null +++ b/Parsers/ASimNetworkSession/Field Mappings/NetworkSession_ProductName_MappingSheet.csv @@ -0,0 +1,163 @@ +ASIMFieldName, ASIMFieldType, ProductFieldName, ProductFieldType, ProductFieldDescription, ProductSampleValue, Logic +AdditionalFields,dynamic,,,,,direct mapping +ASimMatchingHostname,string,,,,,direct mapping +ASimMatchingIpAddr,string,,,,,direct mapping +Dst,string,,,,,direct mapping +DstAppId,string,,,,,direct mapping +DstAppName,string,,,,,direct mapping +DstAppType,string,,,,,direct mapping +DstBytes,long,,,,,direct mapping +DstDescription,string,,,,,direct mapping +DstDeviceType,string,,,,,direct mapping +DstDomain,string,,,,,direct mapping +DstDomainType,string,,,,,direct mapping +DstDvcId,string,,,,,direct mapping +DstDvcIdType,string,,,,,direct mapping +DstFQDN,string,,,,,direct mapping +DstGeoCity,string,,,,,direct mapping +DstGeoCountry,string,,,,,direct mapping +DstGeoLatitude,real,,,,,direct mapping +DstGeoLongitude,real,,,,,direct mapping +DstGeoRegion,string,,,,,direct mapping +DstHostname,string,,,,,direct mapping +DstInterfaceGuid,string,,,,,direct mapping +DstInterfaceName,string,,,,,direct mapping +DstIpAddr,string,,,,,direct mapping +DstMacAddr,string,,,,,direct mapping +DstNatIpAddr,string,,,,,direct mapping +DstNatPortNumber,int,,,,,direct mapping +DstOriginalUserType,string,,,,,direct mapping +DstPackets,long,,,,,direct mapping +DstPortNumber,int,,,,,direct mapping +DstProcessGuid,string,,,,,direct mapping +DstProcessId,string,,,,,direct mapping +DstProcessName,string,,,,,direct mapping +DstScopeId,string,,,,,direct mapping +DstUserId,string,,,,,direct mapping +DstUserIdType,string,,,,,direct mapping +DstUsername,string,,,,,direct mapping +DstUsernameType,string,,,,,direct mapping +DstUserType,string,,,,,direct mapping +DstVlanId,string,,,,,direct mapping +DstZone,string,,,,,direct mapping +Duration,int,,,,,direct mapping +Dvc,string,,,,,direct mapping +DvcAction,string,,,,,direct mapping +DvcDescription,string,,,,,direct mapping +DvcDomain,string,,,,,direct mapping +DvcDomainType,string,,,,,direct mapping +DvcFQDN,string,,,,,direct mapping +DvcHostname,string,,,,,direct mapping +DvcId,string,,,,,direct mapping +DvcIdType,string,,,,,direct mapping +DvcInboundInterface,string,,,,,direct mapping +DvcInterface,string,,,,,direct mapping +DvcIpAddr,string,,,,,direct mapping +DvcMacAddr,string,,,,,direct mapping +DvcOriginalAction,string,,,,,direct mapping +DvcOs,string,,,,,direct mapping +DvcOsVersion,string,,,,,direct mapping +DvcOutboundInterface,string,,,,,direct mapping +DvcScope,string,,,,,direct mapping +DvcScopeId,string,,,,,direct mapping +DvcZone,string,,,,,direct mapping +EventCount,int,,,,,direct mapping +EventEndTime,datetime,,,,,direct mapping +EventMessage,string,,,,,direct mapping +EventOriginalResultDetails,string,,,,,direct mapping +EventOriginalSeverity,string,,,,,direct mapping +EventOriginalSubType,string,,,,,direct mapping +EventOriginalType,string,,,,,direct mapping +EventOriginalUid,string,,,,,direct mapping +EventOwner,string,,,,,direct mapping +EventProduct,string,,,,,direct mapping +EventProductVersion,string,,,,,direct mapping +EventReportUrl,string,,,,,direct mapping +EventResult,string,,,,,direct mapping +EventResultDetails,string,,,,,direct mapping +EventSchema,string,,,,,direct mapping +EventSchemaVersion,string,,,,,direct mapping +EventSeverity,string,,,,,direct mapping +EventStartTime,datetime,,,,,direct mapping +EventSubType,string,,,,,direct mapping +EventType,string,,,,,direct mapping +EventUid,string,,,,,direct mapping +EventVendor,string,,,,,direct mapping +Hostname,string,,,,,direct mapping +InnerVlanId,string,,,,,direct mapping +IpAddr,string,,,,,direct mapping +NetworkApplicationProtocol,string,,,,,direct mapping +NetworkBytes,long,,,,,direct mapping +NetworkConnectionHistory,string,,,,,direct mapping +NetworkDirection,string,,,,,direct mapping +NetworkDuration,int,,,,,direct mapping +NetworkIcmpCode,int,,,,,direct mapping +NetworkIcmpType,string,,,,,direct mapping +NetworkPackets,long,,,,,direct mapping +NetworkProtocol,string,,,,,direct mapping +NetworkProtocolVersion,string,,,,,direct mapping +NetworkRuleName,string,,,,,direct mapping +NetworkRuleNumber,int,,,,,direct mapping +NetworkSessionId,string,,,,,direct mapping +OuterVlanId,string,,,,,direct mapping +Rule,string,,,,,direct mapping +SessionId,string,,,,,direct mapping +Src,string,,,,,direct mapping +SrcAppId,string,,,,,direct mapping +SrcAppName,string,,,,,direct mapping +SrcAppType,string,,,,,direct mapping +SrcBytes,long,,,,,direct mapping +SrcDescription,string,,,,,direct mapping +SrcDeviceType,string,,,,,direct mapping +SrcDomain,string,,,,,direct mapping +SrcDomainType,string,,,,,direct mapping +SrcDvcId,string,,,,,direct mapping +SrcDvcIdType,string,,,,,direct mapping +SrcFQDN,string,,,,,direct mapping +SrcGeoCity,string,,,,,direct mapping +SrcGeoCountry,string,,,,,direct mapping +SrcGeoLatitude,real,,,,,direct mapping +SrcGeoLongitude,real,,,,,direct mapping +SrcGeoRegion,string,,,,,direct mapping +SrcHostname,string,,,,,direct mapping +SrcInterfaceGuid,string,,,,,direct mapping +SrcInterfaceName,string,,,,,direct mapping +SrcIpAddr,string,,,,,direct mapping +SrcMacAddr,string,,,,,direct mapping +SrcNatIpAddr,string,,,,,direct mapping +SrcNatPortNumber,int,,,,,direct mapping +SrcOriginalUserType,string,,,,,direct mapping +SrcPackets,long,,,,,direct mapping +SrcPortNumber,int,,,,,direct mapping +SrcProcessGuid,string,,,,,direct mapping +SrcProcessId,string,,,,,direct mapping +SrcProcessName,string,,,,,direct mapping +SrcScopeId,string,,,,,direct mapping +SrcUserId,string,,,,,direct mapping +SrcUserIdType,string,,,,,direct mapping +SrcUsername,string,,,,,direct mapping +SrcUsernameType,string,,,,,direct mapping +SrcUserType,string,,,,,direct mapping +SrcVlanId,string,,,,,direct mapping +SrcZone,string,,,,,direct mapping +TcpFlagsAck,bool,,,,,direct mapping +TcpFlagsFin,bool,,,,,direct mapping +TcpFlagsPsh,bool,,,,,direct mapping +TcpFlagsRst,bool,,,,,direct mapping +TcpFlagsSyn,bool,,,,,direct mapping +TcpFlagsUrg,bool,,,,,direct mapping +ThreatCategory,string,,,,,direct mapping +ThreatConfidence,int,,,,,direct mapping +ThreatField,string,,,,,direct mapping +ThreatFirstReportedTime,datetime,,,,,direct mapping +ThreatId,string,,,,,direct mapping +ThreatIpAddr,string,,,,,direct mapping +ThreatIsActive,bool,,,,,direct mapping +ThreatLastReportedTime,datetime,,,,,direct mapping +ThreatName,string,,,,,direct mapping +ThreatOriginalConfidence,string,,,,,direct mapping +ThreatOriginalRiskLevel,string,,,,,direct mapping +ThreatRiskLevel,int,,,,,direct mapping +TimeGenerated,datetime,,,,,direct mapping +Type,string,,,,,direct mapping +User,string,,,,,direct mapping diff --git a/Parsers/ASimProcessEvent/Field Mappings/ProcessEvent_ProductName_MappingSheet.csv b/Parsers/ASimProcessEvent/Field Mappings/ProcessEvent_ProductName_MappingSheet.csv new file mode 100644 index 0000000000..7e43dd269d --- /dev/null +++ b/Parsers/ASimProcessEvent/Field Mappings/ProcessEvent_ProductName_MappingSheet.csv @@ -0,0 +1,150 @@ +ASIMFieldName, ASIMFieldType, ProductFieldName, ProductFieldType, ProductFieldDescription, ProductSampleValue, Logic +ActingProcessCommandLine,string,,,,,direct mapping +ActingProcessCreationTime,datetime,,,,,direct mapping +ActingProcessFileCompany,string,,,,,direct mapping +ActingProcessFileDescription,string,,,,,direct mapping +ActingProcessFileInternalName,string,,,,,direct mapping +ActingProcessFilename,string,,,,,direct mapping +ActingProcessFileOriginalName,string,,,,,direct mapping +ActingProcessFileProduct,string,,,,,direct mapping +ActingProcessFileSize,long,,,,,direct mapping +ActingProcessFileVersion,string,,,,,direct mapping +ActingProcessGuid,string,,,,,direct mapping +ActingProcessId,string,,,,,direct mapping +ActingProcessIMPHASH,string,,,,,direct mapping +ActingProcessInjectedAddress,string,,,,,direct mapping +ActingProcessIntegrityLevel,string,,,,,direct mapping +ActingProcessIsHidden,bool,,,,,direct mapping +ActingProcessMD5,string,,,,,direct mapping +ActingProcessName,string,,,,,direct mapping +ActingProcessSHA1,string,,,,,direct mapping +ActingProcessSHA256,string,,,,,direct mapping +ActingProcessSHA512,string,,,,,direct mapping +ActingProcessTokenElevation,string,,,,,direct mapping +ActorOriginalUserType,string,,,,,direct mapping +ActorScope,string,,,,,direct mapping +ActorScopeId,string,,,,,direct mapping +ActorSessionId,string,,,,,direct mapping +ActorUserAadId,string,,,,,direct mapping +ActorUserId,string,,,,,direct mapping +ActorUserIdType,string,,,,,direct mapping +ActorUsername,string,,,,,direct mapping +ActorUsernameType,string,,,,,direct mapping +ActorUserSid,string,,,,,direct mapping +ActorUserType,string,,,,,direct mapping +ActorUserUpn,string,,,,,direct mapping +AdditionalFields,dynamic,,,,,direct mapping +CommandLine,string,,,,,direct mapping +Dvc,string,,,,,direct mapping +DvcAction,string,,,,,direct mapping +DvcDescription,string,,,,,direct mapping +DvcDomain,string,,,,,direct mapping +DvcDomainType,string,,,,,direct mapping +DvcFQDN,string,,,,,direct mapping +DvcHostname,string,,,,,direct mapping +DvcId,string,,,,,direct mapping +DvcIdType,string,,,,,direct mapping +DvcInterface,string,,,,,direct mapping +DvcIpAddr,string,,,,,direct mapping +DvcMacAddr,string,,,,,direct mapping +DvcOriginalAction,string,,,,,direct mapping +DvcOs,string,,,,,direct mapping +DvcOsVersion,string,,,,,direct mapping +DvcScope,string,,,,,direct mapping +DvcScopeId,string,,,,,direct mapping +DvcZone,string,,,,,direct mapping +EventCount,int,,,,,direct mapping +EventEndTime,datetime,,,,,direct mapping +EventMessage,string,,,,,direct mapping +EventOriginalResultDetails,string,,,,,direct mapping +EventOriginalSeverity,string,,,,,direct mapping +EventOriginalSubType,string,,,,,direct mapping +EventOriginalType,string,,,,,direct mapping +EventOriginalUid,string,,,,,direct mapping +EventOwner,string,,,,,direct mapping +EventProduct,string,,,,,direct mapping +EventProductVersion,string,,,,,direct mapping +EventReportUrl,string,,,,,direct mapping +EventResult,string,,,,,direct mapping +EventResultDetails,string,,,,,direct mapping +EventSchema,string,,,,,direct mapping +EventSchemaVersion,string,,,,,direct mapping +EventSeverity,string,,,,,direct mapping +EventStartTime,datetime,,,,,direct mapping +EventSubType,string,,,,,direct mapping +EventType,string,,,,,direct mapping +EventUid,string,,,,,direct mapping +EventVendor,string,,,,,direct mapping +Hash,string,,,,,direct mapping +HashType,string,,,,,direct mapping +ParentProcessCreationTime,datetime,,,,,direct mapping +ParentProcessFileCompany,string,,,,,direct mapping +ParentProcessFileDescription,string,,,,,direct mapping +ParentProcessFileProduct,string,,,,,direct mapping +ParentProcessFileVersion,string,,,,,direct mapping +ParentProcessGuid,string,,,,,direct mapping +ParentProcessId,string,,,,,direct mapping +ParentProcessIMPHASH,string,,,,,direct mapping +ParentProcessInjectedAddress,string,,,,,direct mapping +ParentProcessIntegrityLevel,string,,,,,direct mapping +ParentProcessIsHidden,bool,,,,,direct mapping +ParentProcessMD5,string,,,,,direct mapping +ParentProcessName,string,,,,,direct mapping +ParentProcessSHA1,string,,,,,direct mapping +ParentProcessSHA256,string,,,,,direct mapping +ParentProcessSHA512,string,,,,,direct mapping +ParentProcessTokenElevation,string,,,,,direct mapping +Process,string,,,,,direct mapping +RuleName,string,,,,,direct mapping +RuleNumber,int,,,,,direct mapping +TargetOriginalUserType,string,,,,,direct mapping +TargetProcessCommandLine,string,,,,,direct mapping +TargetProcessCreationTime,datetime,,,,,direct mapping +TargetProcessCurrentDirectory,string,,,,,direct mapping +TargetProcessFileCompany,string,,,,,direct mapping +TargetProcessFileDescription,string,,,,,direct mapping +TargetProcessFileInternalName,string,,,,,direct mapping +TargetProcessFilename,string,,,,,direct mapping +TargetProcessFileOriginalName,string,,,,,direct mapping +TargetProcessFileProduct,string,,,,,direct mapping +TargetProcessFileSize,long,,,,,direct mapping +TargetProcessFileVersion,string,,,,,direct mapping +TargetProcessGuid,string,,,,,direct mapping +TargetProcessId,string,,,,,direct mapping +TargetProcessIMPHASH,string,,,,,direct mapping +TargetProcessInjectedAddress,string,,,,,direct mapping +TargetProcessIntegrityLevel,string,,,,,direct mapping +TargetProcessIsHidden,bool,,,,,direct mapping +TargetProcessMD5,string,,,,,direct mapping +TargetProcessName,string,,,,,direct mapping +TargetProcessSHA1,string,,,,,direct mapping +TargetProcessSHA256,string,,,,,direct mapping +TargetProcessSHA512,string,,,,,direct mapping +TargetProcessStatusCode,string,,,,,direct mapping +TargetProcessTokenElevation,string,,,,,direct mapping +TargetScope,string,,,,,direct mapping +TargetScopeId,string,,,,,direct mapping +TargetUserAadId,string,,,,,direct mapping +TargetUserId,string,,,,,direct mapping +TargetUserIdType,string,,,,,direct mapping +TargetUsername,string,,,,,direct mapping +TargetUsernameType,string,,,,,direct mapping +TargetUserSessionGuid,string,,,,,direct mapping +TargetUserSessionId,string,,,,,direct mapping +TargetUserSid,string,,,,,direct mapping +TargetUserType,string,,,,,direct mapping +TargetUserUpn,string,,,,,direct mapping +ThreatCategory,string,,,,,direct mapping +ThreatConfidence,int,,,,,direct mapping +ThreatField,string,,,,,direct mapping +ThreatFirstReportedTime,datetime,,,,,direct mapping +ThreatId,string,,,,,direct mapping +ThreatIsActive,bool,,,,,direct mapping +ThreatLastReportedTime,datetime,,,,,direct mapping +ThreatName,string,,,,,direct mapping +ThreatOriginalConfidence,string,,,,,direct mapping +ThreatOriginalRiskLevel,string,,,,,direct mapping +ThreatRiskLevel,int,,,,,direct mapping +TimeGenerated,datetime,,,,,direct mapping +Type,string,,,,,direct mapping +User,string,,,,,direct mapping diff --git a/Parsers/ASimRegistryEvent/Field Mappings/RegistryEvent_ProductName_MappingSheet.csv b/Parsers/ASimRegistryEvent/Field Mappings/RegistryEvent_ProductName_MappingSheet.csv new file mode 100644 index 0000000000..10523a4f27 --- /dev/null +++ b/Parsers/ASimRegistryEvent/Field Mappings/RegistryEvent_ProductName_MappingSheet.csv @@ -0,0 +1,70 @@ +ASIMFieldName, ASIMFieldType, ProductFieldName, ProductFieldType, ProductFieldDescription, ProductSampleValue, Logic +ActingProcessGuid,string,,,,,direct mapping +ActingProcessId,string,,,,,direct mapping +ActingProcessName,string,,,,,direct mapping +ActorSessionId,string,,,,,direct mapping +ActorUserId,string,,,,,direct mapping +ActorUserIdType,string,,,,,direct mapping +ActorUsername,string,,,,,direct mapping +ActorUsernameType,string,,,,,direct mapping +AdditionalFields,dynamic,,,,,direct mapping +DstDescription,string,,,,,direct mapping +Dvc,string,,,,,direct mapping +DvcDescription,string,,,,,direct mapping +DvcHostname,string,,,,,direct mapping +DvcId,string,,,,,direct mapping +DvcIpAddr,string,,,,,direct mapping +DvcMacAddr,string,,,,,direct mapping +DvcOs,string,,,,,direct mapping +DvcOsVersion,string,,,,,direct mapping +DvcScope,string,,,,,direct mapping +DvcScopeId,string,,,,,direct mapping +EventCount,int,,,,,direct mapping +EventEndTime,datetime,,,,,direct mapping +EventMessage,string,,,,,direct mapping +EventOriginalSeverity,string,,,,,direct mapping +EventOriginalSubType,string,,,,,direct mapping +EventOriginalType,string,,,,,direct mapping +EventOriginalUid,string,,,,,direct mapping +EventOwner,string,,,,,direct mapping +EventProduct,string,,,,,direct mapping +EventProductVersion,string,,,,,direct mapping +EventReportUrl,string,,,,,direct mapping +EventResult,string,,,,,direct mapping +EventSchema,string,,,,,direct mapping +EventSchemaVersion,string,,,,,direct mapping +EventSeverity,string,,,,,direct mapping +EventStartTime,datetime,,,,,direct mapping +EventType,string,,,,,direct mapping +EventUid,string,,,,,direct mapping +EventVendor,string,,,,,direct mapping +ParentProcessGuid,string,,,,,direct mapping +ParentProcessId,string,,,,,direct mapping +ParentProcessName,string,,,,,direct mapping +Process,string,,,,,direct mapping +RegistryKey,string,,,,,direct mapping +RegistryPreviousKey,string,,,,,direct mapping +RegistryPreviousValue,string,,,,,direct mapping +RegistryPreviousValueData,string,,,,,direct mapping +RegistryPreviousValueType,string,,,,,direct mapping +RegistryValue,string,,,,,direct mapping +RegistryValueData,string,,,,,direct mapping +RegistryValueType,string,,,,,direct mapping +Rule,string,,,,,direct mapping +RuleName,string,,,,,direct mapping +RuleNumber,int,,,,,direct mapping +SrcDescription,string,,,,,direct mapping +ThreatCategory,string,,,,,direct mapping +ThreatConfidence,int,,,,,direct mapping +ThreatField,string,,,,,direct mapping +ThreatFirstReportedTime,datetime,,,,,direct mapping +ThreatId,string,,,,,direct mapping +ThreatIsActive,bool,,,,,direct mapping +ThreatLastReportedTime,datetime,,,,,direct mapping +ThreatName,string,,,,,direct mapping +ThreatOriginalConfidence,string,,,,,direct mapping +ThreatOriginalRiskLevel,string,,,,,direct mapping +ThreatRiskLevel,int,,,,,direct mapping +TimeGenerated,datetime,,,,,direct mapping +Type,string,,,,,direct mapping +User,string,,,,,direct mapping diff --git a/Parsers/ASimUserManagement/Field Mappings/UserManagement_ProductName_MappingSheet.csv b/Parsers/ASimUserManagement/Field Mappings/UserManagement_ProductName_MappingSheet.csv new file mode 100644 index 0000000000..acb2683552 --- /dev/null +++ b/Parsers/ASimUserManagement/Field Mappings/UserManagement_ProductName_MappingSheet.csv @@ -0,0 +1,117 @@ +ASIMFieldName, ASIMFieldType, ProductFieldName, ProductFieldType, ProductFieldDescription, ProductSampleValue, Logic +ActingAppId,string,,,,,direct mapping +ActingAppName,string,,,,,direct mapping +ActingAppName,string,,,,,direct mapping +ActingAppType,string,,,,,direct mapping +ActingOriginalAppType,string,,,,,direct mapping +ActorOriginalUserType,string,,,,,direct mapping +ActorScope,string,,,,,direct mapping +ActorScopeId,string,,,,,direct mapping +ActorSessionId,string,,,,,direct mapping +ActorUserAadId,string,,,,,direct mapping +ActorUserId,string,,,,,direct mapping +ActorUserIdType,string,,,,,direct mapping +ActorUsername,string,,,,,direct mapping +ActorUsernameType,string,,,,,direct mapping +ActorUserSid,string,,,,,direct mapping +ActorUserType,string,,,,,direct mapping +AdditionalFields,dynamic,,,,,direct mapping +Dvc,string,,,,,direct mapping +DvcAction,string,,,,,direct mapping +DvcDescription,string,,,,,direct mapping +DvcDomain,string,,,,,direct mapping +DvcDomainType,string,,,,,direct mapping +DvcFQDN,string,,,,,direct mapping +DvcHostname,string,,,,,direct mapping +DvcId,string,,,,,direct mapping +DvcIdType,string,,,,,direct mapping +DvcInterface,string,,,,,direct mapping +DvcIpAddr,string,,,,,direct mapping +DvcMacAddr,string,,,,,direct mapping +DvcOriginalAction,string,,,,,direct mapping +DvcOs,string,,,,,direct mapping +DvcOsVersion,string,,,,,direct mapping +DvcScope,string,,,,,direct mapping +DvcScopeId,string,,,,,direct mapping +DvcZone,string,,,,,direct mapping +EventCount,int,,,,,direct mapping +EventEndTime,datetime,,,,,direct mapping +EventMessage,string,,,,,direct mapping +EventOriginalResultDetails,string,,,,,direct mapping +EventOriginalSeverity,string,,,,,direct mapping +EventOriginalSubType,string,,,,,direct mapping +EventOriginalType,string,,,,,direct mapping +EventOriginalUid,string,,,,,direct mapping +EventOwner,string,,,,,direct mapping +EventProduct,string,,,,,direct mapping +EventProductVersion,string,,,,,direct mapping +EventReportUrl,string,,,,,direct mapping +EventResult,string,,,,,direct mapping +EventResultDetails,string,,,,,direct mapping +EventSchema,string,,,,,direct mapping +EventSchemaVersion,string,,,,,direct mapping +EventSeverity,string,,,,,direct mapping +EventStartTime,datetime,,,,,direct mapping +EventSubType,string,,,,,direct mapping +EventType,string,,,,,direct mapping +EventUid,string,,,,,direct mapping +EventVendor,string,,,,,direct mapping +GroupId,string,,,,,direct mapping +GroupIdType,string,,,,,direct mapping +GroupName,string,,,,,direct mapping +GroupNameType,string,,,,,direct mapping +GroupOriginalType,string,,,,,direct mapping +GroupType,string,,,,,direct mapping +Hostname,string,,,,,direct mapping +HttpUserAgent,string,,,,,direct mapping +IpAddr,string,,,,,direct mapping +NewPropertyValue,string,,,,,direct mapping +PreviousPropertyValue,string,,,,,direct mapping +Rule,string,,,,,direct mapping +RuleName,string,,,,,direct mapping +RuleNumber,int,,,,,direct mapping +Src,string,,,,,direct mapping +SrcDescription,string,,,,,direct mapping +SrcDeviceType,string,,,,,direct mapping +SrcDomain,string,,,,,direct mapping +SrcDomainType,string,,,,,direct mapping +SrcDvcId,string,,,,,direct mapping +SrcDvcIdType,string,,,,,direct mapping +SrcDvcScope,string,,,,,direct mapping +SrcDvcScopeId,string,,,,,direct mapping +SrcFQDN,string,,,,,direct mapping +SrcGeoCity,string,,,,,direct mapping +SrcGeoCountry,string,,,,,direct mapping +SrcGeoLatitude,real,,,,,direct mapping +SrcGeoLongitude,real,,,,,direct mapping +SrcGeoRegion,string,,,,,direct mapping +SrcHostname,string,,,,,direct mapping +SrcIpAddr,string,,,,,direct mapping +SrcMacAddr,string,,,,,direct mapping +SrcOriginalRiskLevel,string,,,,,direct mapping +SrcPortNumber,int,,,,,direct mapping +SrcRiskLevel,int,,,,,direct mapping +TargetOriginalUserType,string,,,,,direct mapping +TargetUserId,string,,,,,direct mapping +TargetUserIdType,string,,,,,direct mapping +TargetUsername,string,,,,,direct mapping +TargetUsernameType,string,,,,,direct mapping +TargetUserScope,string,,,,,direct mapping +TargetUserScopeId,string,,,,,direct mapping +TargetUserSessionId,string,,,,,direct mapping +TargetUserType,string,,,,,direct mapping +TargetUserUid,string,,,,,direct mapping +ThreatCategory,string,,,,,direct mapping +ThreatConfidence,int,,,,,direct mapping +ThreatField,string,,,,,direct mapping +ThreatFirstReportedTime,datetime,,,,,direct mapping +ThreatId,string,,,,,direct mapping +ThreatIsActive,bool,,,,,direct mapping +ThreatLastReportedTime,datetime,,,,,direct mapping +ThreatName,string,,,,,direct mapping +ThreatOriginalConfidence,string,,,,,direct mapping +ThreatOriginalRiskLevel,string,,,,,direct mapping +ThreatRiskLevel,int,,,,,direct mapping +TimeGenerated,datetime,,,,,direct mapping +UpdatedPropertyName,string,,,,,direct mapping +User,string,,,,,direct mapping diff --git a/Parsers/ASimWebSession/Field Mappings/WebSession_ProductName_MappingSheet.csv b/Parsers/ASimWebSession/Field Mappings/WebSession_ProductName_MappingSheet.csv new file mode 100644 index 0000000000..a9ee5510d9 --- /dev/null +++ b/Parsers/ASimWebSession/Field Mappings/WebSession_ProductName_MappingSheet.csv @@ -0,0 +1,178 @@ +ASIMFieldName, ASIMFieldType, ProductFieldName, ProductFieldType, ProductFieldDescription, ProductSampleValue, Logic +AdditionalFields,dynamic,,,,,direct mapping +ASimMatchingIpAddr,string,,,,,direct mapping +Dst,string,,,,,direct mapping +DstAppId,string,,,,,direct mapping +DstAppName,string,,,,,direct mapping +DstAppType,string,,,,,direct mapping +DstBytes,long,,,,,direct mapping +DstDescription,string,,,,,direct mapping +DstDeviceType,string,,,,,direct mapping +DstDomain,string,,,,,direct mapping +DstDomainType,string,,,,,direct mapping +DstDvcId,string,,,,,direct mapping +DstDvcIdType,string,,,,,direct mapping +DstFQDN,string,,,,,direct mapping +DstGeoCity,string,,,,,direct mapping +DstGeoCountry,string,,,,,direct mapping +DstGeoLatitude,real,,,,,direct mapping +DstGeoLongitude,real,,,,,direct mapping +DstGeoRegion,string,,,,,direct mapping +DstHostname,string,,,,,direct mapping +DstInterfaceGuid,string,,,,,direct mapping +DstInterfaceName,string,,,,,direct mapping +DstIpAddr,string,,,,,direct mapping +DstMacAddr,string,,,,,direct mapping +DstNatIpAddr,string,,,,,direct mapping +DstNatPortNumber,int,,,,,direct mapping +DstOriginalUserType,string,,,,,direct mapping +DstPackets,long,,,,,direct mapping +DstPortNumber,int,,,,,direct mapping +DstUserId,string,,,,,direct mapping +DstUserIdType,string,,,,,direct mapping +DstUsername,string,,,,,direct mapping +DstUsernameType,string,,,,,direct mapping +DstUserType,string,,,,,direct mapping +DstVlanId,sting,,,,,direct mapping +DstZone,string,,,,,direct mapping +Duration,int,,,,,direct mapping +Dvc,string,,,,,direct mapping +DvcAction,string,,,,,direct mapping +DvcDescription,string,,,,,direct mapping +DvcDomain,string,,,,,direct mapping +DvcDomainType,string,,,,,direct mapping +DvcFQDN,string,,,,,direct mapping +DvcHostname,string,,,,,direct mapping +DvcId,string,,,,,direct mapping +DvcIdType,string,,,,,direct mapping +DvcInboundInterface,string,,,,,direct mapping +DvcIpAddr,string,,,,,direct mapping +DvcMacAddr,string,,,,,direct mapping +DvcOriginalAction,string,,,,,direct mapping +DvcOutboundInterface,string,,,,,direct mapping +DvcScope,string,,,,,direct mapping +DvcScopeId,string,,,,,direct mapping +DvcZone,string,,,,,direct mapping +EventCount,int,,,,,direct mapping +EventEndTime,datetime,,,,,direct mapping +EventMessage,string,,,,,direct mapping +EventOriginalResultDetails,string,,,,,direct mapping +EventOriginalSeverity,string,,,,,direct mapping +EventOriginalSubType,string,,,,,direct mapping +EventOriginalType,string,,,,,direct mapping +EventOriginalUid,string,,,,,direct mapping +EventOwner,string,,,,,direct mapping +EventProduct,string,,,,,direct mapping +EventProductVersion,string,,,,,direct mapping +EventReportUrl,string,,,,,direct mapping +EventResult,string,,,,,direct mapping +EventResultDetails,string,,,,,direct mapping +EventSchema,string,,,,,direct mapping +EventSchemaVersion,string,,,,,direct mapping +EventSeverity,string,,,,,direct mapping +EventStartTime,datetime,,,,,direct mapping +EventSubType,string,,,,,direct mapping +EventType,string,,,,,direct mapping +EventUid,string,,,,,direct mapping +EventVendor,string,,,,,direct mapping +FileContentType,string,,,,,direct mapping +FileMD5,string,,,,,direct mapping +FileName,string,,,,,direct mapping +FileSHA1,string,,,,,direct mapping +FileSHA256,string,,,,,direct mapping +FileSHA512,string,,,,,direct mapping +FileSize,long,,,,,direct mapping +Hash,string,,,,,direct mapping +HashType,string,,,,,direct mapping +Hostname,string,,,,,direct mapping +HttpContentFormat,string,,,,,direct mapping +HttpContentType,string,,,,,direct mapping +HttpCookie,string,,,,,direct mapping +HttpHost,string,,,,,direct mapping +HttpIsProxied,bool,,,,,direct mapping +HttpReferrer,string,,,,,direct mapping +HttpRequestBodyBytes,long,,,,,direct mapping +HttpRequestCacheControl,string,,,,,direct mapping +HttpRequestHeaderCount,int,,,,,direct mapping +HttpRequestMethod,string,,,,,direct mapping +HttpRequestTime,int,,,,,direct mapping +HttpRequestXff,string,,,,,direct mapping +HttpResponseBodyBytes,long,,,,,direct mapping +HttpResponseCacheControl,string,,,,,direct mapping +HttpResponseExpires,string,,,,,direct mapping +HttpResponseHeaderCount,int,,,,,direct mapping +HttpResponseTime,int,,,,,direct mapping +HttpStatusCode,string,,,,,direct mapping +HttpUserAgent,string,,,,,direct mapping +HttpVersion,string,,,,,direct mapping +InnerVlanId,string,,,,,direct mapping +IpAddr,string,,,,,direct mapping +NetworkApplicationProtocol,string,,,,,direct mapping +NetworkBytes,long,,,,,direct mapping +NetworkConnectionHistory,string,,,,,direct mapping +NetworkDirection,string,,,,,direct mapping +NetworkDuration,int,,,,,direct mapping +NetworkIcmpCode,int,,,,,direct mapping +NetworkIcmpType,string,,,,,direct mapping +NetworkPackets,long,,,,,direct mapping +NetworkProtocol,string,,,,,direct mapping +NetworkProtocolVersion,string,,,,,direct mapping +NetworkSessionId,string,,,,,direct mapping +OuterVlanId,string,,,,,direct mapping +Rule,string,,,,,direct mapping +RuleName,string,,,,,direct mapping +RuleNumber,int,,,,,direct mapping +SessionId,string,,,,,direct mapping +Src,string,,,,,direct mapping +SrcAppId,string,,,,,direct mapping +SrcAppName,string,,,,,direct mapping +SrcAppType,string,,,,,direct mapping +SrcBytes,long,,,,,direct mapping +SrcDescription,string,,,,,direct mapping +SrcDeviceType,string,,,,,direct mapping +SrcDomain,string,,,,,direct mapping +SrcDomainType,string,,,,,direct mapping +SrcDvcId,string,,,,,direct mapping +SrcDvcIdType,string,,,,,direct mapping +SrcFQDN,string,,,,,direct mapping +SrcGeoCity,string,,,,,direct mapping +SrcGeoCountry,string,,,,,direct mapping +SrcGeoLatitude,real,,,,,direct mapping +SrcGeoLongitude,real,,,,,direct mapping +SrcGeoRegion,string,,,,,direct mapping +SrcHostname,string,,,,,direct mapping +SrcInterfaceGuid,string,,,,,direct mapping +SrcInterfaceName,string,,,,,direct mapping +SrcIpAddr,string,,,,,direct mapping +SrcMacAddr,string,,,,,direct mapping +SrcNatIpAddr,string,,,,,direct mapping +SrcNatPortNumber,int,,,,,direct mapping +SrcOriginalUserType,string,,,,,direct mapping +SrcPackets,long,,,,,direct mapping +SrcPortNumber,int,,,,,direct mapping +SrcUserId,string,,,,,direct mapping +SrcUserIdType,string,,,,,direct mapping +SrcUsername,string,,,,,direct mapping +SrcUsernameType,string,,,,,direct mapping +SrcUserType,string,,,,,direct mapping +SrcVlanId,sting,,,,,direct mapping +SrcZone,string,,,,,direct mapping +ThreatCategory,string,,,,,direct mapping +ThreatConfidence,int,,,,,direct mapping +ThreatField,string,,,,,direct mapping +ThreatFirstReportedTime,datetime,,,,,direct mapping +ThreatId,string,,,,,direct mapping +ThreatIpAddr,string,,,,,direct mapping +ThreatIsActive,bool,,,,,direct mapping +ThreatLastReportedTime,datetime,,,,,direct mapping +ThreatName,string,,,,,direct mapping +ThreatOriginalConfidence,string,,,,,direct mapping +ThreatOriginalRiskLevel,string,,,,,direct mapping +ThreatRiskLevel,int,,,,,direct mapping +TimeGenerated,datetime,,,,,direct mapping +Type,string,,,,,direct mapping +Url,string,,,,,direct mapping +UrlCategory,string,,,,,direct mapping +UrlOriginal,string,,,,,direct mapping +User,string,,,,,direct mapping +UserAgent,string,,,,,direct mapping