...
| Note |
|---|
Extra fields Fields marked as Extra in the table below are not shown by default in data tables and need to be explicitly requested in the query. You can find them marked as Extra when you perform a query so they can be easily identified. Learn more about this in Selecting unrevealed columns. |
Field | Type | Source field name | Extra fields |
|---|---|---|---|
eventdate |
|
| |
source |
|
|
firewall_name |
|
| |
firewall_cluster |
|
|
severity |
|
|
source_ip |
|
|
source_ipv4 |
| ||
source_port |
|
|
destination_ip |
int4
|
|
destination_ipv4 |
|
dstPort
int4destination_port |
|
| |
user |
|
| |
virus_name |
|
| |
virus_subtype |
|
| |
hostchain |
|
| ✓ |
tag |
|
| ✓ |
rawMessage |
| rawSource | ✓ |
Field transformations
Even though all source tables have several features in common, they have some particularities that make it necessary to undergo a set of transformations to harmonize them for the union table. The most common transformations comprise changes in the data type or the application of rules when several columns in the source table feed a single column in the union table. You can find below the detailed list of transformations in each source table.
...
| Anchor | ||||
|---|---|---|---|---|
|
Field in union table | Field in source table | Field transformation | Type | Extra fields | |
|---|---|---|---|---|---|
eventdate | eventdate |
|
| ||
source | - |
|
|
fwname
devname
| Code Block |
|---|
devname ?: 'default' |
str
fwcluster
vd
| Code Block |
|---|
vd ?: 'default' |
str
level
firewall_name | firewall_name |
|
| |
firewall_cluster | firewall_cluster |
|
| |
severity | severity |
|
| |
source_ip | srcip_str |
|
|
srcIp
source_ipv4 | source_ipv4 |
|
|
srcPort
srcport
int4
dstIp
dstip
source_port | srcport |
|
| |||
destination_ip | dstip |
|
| |||
destination_ipv4 | destination_ipv4 |
|
|
destination_port | dstport |
int4
|
| |||||
user | user |
|
| |||
virus_name | virus_name |
|
| |||
virus_subtype | virus_subtype |
|
| |||
rawSource | rawMessage |
|
| ✓ |
rawMessage |
rawMessage |
|
| ✓ |
hostchain |
hostchain |
|
| ✓ |
tag |
tag |
|
| ✓ |
| Anchor | ||||
|---|---|---|---|---|
|
Field in union table | Field in source table | Field transformation | Type | Extra fields | |
|---|---|---|---|---|---|
eventdate | eventdate |
|
| ||
source | - |
|
|
fwname
sn
| Code Block |
|---|
sn ?: 'default' |
str
fwcluster
fw
| Code Block |
|---|
fw ?: 'default' |
str
level
pri
| Code Block |
|---|
(pri -> 0) ? 'emergency' : (pri -> 1) ? 'alert' : (pri -> 2) ? 'critical' : (pri -> 3) ? 'error' : (pri -> 4) ? 'warning' : (pri -> 5) ? 'notice' : (pri -> 6) ? 'info' : (pri -> 7) ? 'debug' : null('') |
str
srcIp
srcIp
ip4
srcPort
srcPort
| Code Block |
|---|
int4(srcPort) |
int4
dstIp
dstIp
ip4
dstPort
dstPort
| Code Block |
|---|
int4(dstPort) |
int4
user
srcIp
usr
firewall_name | firewall_name |
|
| |||
firewall_cluster | firewall_cluster |
|
| |||
severity | severity |
|
| |||
source_ip | srcIp |
|
| |||
source_ipv4 | source_ipv4 |
|
| |||
source_port | srcPort |
|
| |||
destination_ip | dstIp |
|
| |||
destination_ipv4 | destination_ipv4 |
|
| |||
destination_port | dstPort |
|
| |||
user | usr srcIp |
|
| |||
virus_name |
virus_name |
| Code Block |
|---|
peek(msg, re("Gateway Anti-Virus Alert:(.*) blocked"), 1) |
str
subtype
msg
|
| |||
virus_subtype | virus_subtype |
|
| |
rawSource | rawMessage |
|
| ✓ |
rawMessage |
rawMessage |
|
| ✓ |
hostchain |
hostchain |
|
| ✓ |
tag |
tag |
|
| ✓ |